General
-
Target
2025-03-30_21798cca59362fe9a8e8e372c3c9a364_black-basta_cobalt-strike_satacom
-
Size
533KB
-
Sample
250330-c5tcraysdx
-
MD5
21798cca59362fe9a8e8e372c3c9a364
-
SHA1
0149cac86d324e69ce96de65b96427501062381a
-
SHA256
20a0c14423a568108c1490f4ddfcdb55453de54c36f141224ed1062b660278ba
-
SHA512
7efaf4a00a91de65f18bb0bb607ab0720f2d9d640287f0a8649c6b09427e935ecb2b6fbdd25b2a7fa85d96d2f58772864abe63f88b81ca78670e35cb5d731188
-
SSDEEP
12288:HdoutuQxK5fWYgeWYg955/155/8F9F7UooSUm98uhMmv:9tbxK5FvjU87
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-30_21798cca59362fe9a8e8e372c3c9a364_black-basta_cobalt-strike_satacom.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-30_21798cca59362fe9a8e8e372c3c9a364_black-basta_cobalt-strike_satacom.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\PerfLogs\Admin\How to decrypt my data.txt
lockbit
https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe
Targets
-
-
Target
2025-03-30_21798cca59362fe9a8e8e372c3c9a364_black-basta_cobalt-strike_satacom
-
Size
533KB
-
MD5
21798cca59362fe9a8e8e372c3c9a364
-
SHA1
0149cac86d324e69ce96de65b96427501062381a
-
SHA256
20a0c14423a568108c1490f4ddfcdb55453de54c36f141224ed1062b660278ba
-
SHA512
7efaf4a00a91de65f18bb0bb607ab0720f2d9d640287f0a8649c6b09427e935ecb2b6fbdd25b2a7fa85d96d2f58772864abe63f88b81ca78670e35cb5d731188
-
SSDEEP
12288:HdoutuQxK5fWYgeWYg955/155/8F9F7UooSUm98uhMmv:9tbxK5FvjU87
Score10/10-
Lockbit family
-
Renames multiple (193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-