blackbasta | fff35c2da67eef6f1a10c585b427ac32e7f06f4e4460542207abcd62264e435f

General

Target

file
Size

1.4MB
Sample

250205-vg8rmsxnck
MD5

b365faebaf416681b5f376c8aa4f4470
SHA1

591d363928f0d5f4629196d60fd899469267da09
SHA256

fff35c2da67eef6f1a10c585b427ac32e7f06f4e4460542207abcd62264e435f
SHA512

e1617284be6fc9652062a92c03578327267a9731075afbc9f05c70328a169e5a5dc1dd625f459896dcb79479d071b486eb9be2559d3431502949e344a32ba0ae
SSDEEP

24576:wjlZDq1Een/s9NUuKF+gEn7gKheviz6GYtVb9BXpV7wldFu8hod/Qodly:wjlreiUuKFS70A059/V7GFadRd

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 9daba746-192e-4867-97be-bcb5b27d1547 *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  file
- Size
  
  1.4MB
- MD5
  
  b365faebaf416681b5f376c8aa4f4470
- SHA1
  
  591d363928f0d5f4629196d60fd899469267da09
- SHA256
  
  fff35c2da67eef6f1a10c585b427ac32e7f06f4e4460542207abcd62264e435f
- SHA512
  
  e1617284be6fc9652062a92c03578327267a9731075afbc9f05c70328a169e5a5dc1dd625f459896dcb79479d071b486eb9be2559d3431502949e344a32ba0ae
- SSDEEP
  
  24576:wjlZDq1Een/s9NUuKF+gEn7gKheviz6GYtVb9BXpV7wldFu8hod/Qodly:wjlreiUuKFS70A059/V7GFadRd
Score

10^/10

discovery blackbasta defense_evasion execution impact persistence ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Blackbasta family
  blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (2428) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Adds Run key to start application
  persistence
behavioral1 behavioral2