blackbasta | 2a94525ad06751b4795f47254c22469ee60ed473b3bf193f6d2ffd704c6d4bd4

General

Target

20492050518.zip
Size

301KB
Sample

241221-tfwv1ssnbk
MD5

9aeb5286f0f50837fcb3c98ebd56a0df
SHA1

80a390fbe147959a0c1dee7224e690c0956d74d3
SHA256

2a94525ad06751b4795f47254c22469ee60ed473b3bf193f6d2ffd704c6d4bd4
SHA512

dee5bfbe3a63e9051c604404c09c36440f016d177bce6966c8aa0c967b5492ca21ce3b729cb46393f9c20f7208c6dc35ae28f554433ef33596a8fdcbc69f33b6
SSDEEP

6144:dVo/9H3RLpig9s8/wGhVt7JKT0KZTTzgu4poRGDzCAgX4:di/xiz84CT7a0K21l4o

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\instructions_read_me.txt

Family

blackbasta

Ransom Note

Hello! If you are reading this, it means we have encrypted your data and took your files. DO NOT PANIC! Yes, this is bad news, but we will have a good ones as well. YES, this is entirely fixable! Our name is BlackBasta Syndicate, and we are the largest, most advanced, and most prolific organized group currently existing. We are the ultimate cyber tradecraft with a credential record of taking down the most advanced, high-profile, and defended companies one can ever imagine. You can Google us later; what you need to know now is that we are business people just like you. We have your data and encrypted your files, but in less than an hour, we can put things back on track: if you pay for our recovery services, you get a decryptor, the data will be deleted from all of our systems and returned to you, and we will give you a security report explaining how we got you. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login: 94351e51-1b7a-4b52-8170-a8c42c418cac This is a link to a secure chat. We will talk there. Inside that chat, we will share a second designated link that only your special team will be able to see. For now, think about the following. This incident hits your network and is stopping you from operating properly. The sooner you get back on track, the better it is. See you in the secure chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  15d891d682d73514401f65f0bd769d27f777462c31c7815e1a0fe119a41ea739
- Size
  
  649KB
- MD5
  
  90e69700399e2b75d7e09b84185640c7
- SHA1
  
  cce479af71b73f1d0c5226b87894aeb5c24aeed2
- SHA256
  
  15d891d682d73514401f65f0bd769d27f777462c31c7815e1a0fe119a41ea739
- SHA512
  
  5bdcecad4af71631278e7d00fd9056a6b62be6212e7f7e00d75e08207ca41fbe3e075ca0699cc963039deb5190225bde16a5522b5ca6c7d943e3b5df80750ceb
- SSDEEP
  
  12288:4ofNGhJvRjVUWEFvScnf316z/OF/NqDxf4qLO1BhwTkwJcqea4VOF:4ofNGhJvRJGf3oJ9f4qLqBhsJveg
Score

10^/10

blackbasta persistence ransomware discovery spyware stealer
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Blackbasta family
  blackbasta
- Renames multiple (4224) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2