General

  • Target

    2025-03-30_21798cca59362fe9a8e8e372c3c9a364_black-basta_cobalt-strike_satacom

  • Size

    533KB

  • Sample

    250330-c5tcraysdx

  • MD5

    21798cca59362fe9a8e8e372c3c9a364

  • SHA1

    0149cac86d324e69ce96de65b96427501062381a

  • SHA256

    20a0c14423a568108c1490f4ddfcdb55453de54c36f141224ed1062b660278ba

  • SHA512

    7efaf4a00a91de65f18bb0bb607ab0720f2d9d640287f0a8649c6b09427e935ecb2b6fbdd25b2a7fa85d96d2f58772864abe63f88b81ca78670e35cb5d731188

  • SSDEEP

    12288:HdoutuQxK5fWYgeWYg955/155/8F9F7UooSUm98uhMmv:9tbxK5FvjU87

Score
10/10

Malware Config

Extracted

Path

C:\PerfLogs\Admin\How to decrypt my data.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free You can contact us in email or qtox. QTox ID Support: 3DF86B12634F4308F81C86251AF940D8F6492A074C8C6F2EFA0D134F024A6E54A324B1813AA0 Email Support: [email protected],[email protected] Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. >>>> Warning >>>> Warning >>>> Advertisement Would you like to earn millions of dollars $$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using QTox messenger without registration and SMS https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe. Using QTox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in Email or qtox. QTox ID Support: 3DF86B12634F4308F81C86251AF940D8F6492A074C8C6F2EFA0D134F024A6E54A324B1813AA0 Email Support: [email protected],[email protected]
URLs

https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe

Targets

    • Target

      2025-03-30_21798cca59362fe9a8e8e372c3c9a364_black-basta_cobalt-strike_satacom

    • Size

      533KB

    • MD5

      21798cca59362fe9a8e8e372c3c9a364

    • SHA1

      0149cac86d324e69ce96de65b96427501062381a

    • SHA256

      20a0c14423a568108c1490f4ddfcdb55453de54c36f141224ed1062b660278ba

    • SHA512

      7efaf4a00a91de65f18bb0bb607ab0720f2d9d640287f0a8649c6b09427e935ecb2b6fbdd25b2a7fa85d96d2f58772864abe63f88b81ca78670e35cb5d731188

    • SSDEEP

      12288:HdoutuQxK5fWYgeWYg955/155/8F9F7UooSUm98uhMmv:9tbxK5FvjU87

    Score
    10/10
    • Lockbit

      Ransomware family with multiple variants released since late 2019.

    • Lockbit family

    • Renames multiple (193) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks