General
-
Target
2025-04-22_588b20c2228a04d7e38d165197e17c33_black-basta_cobalt-strike_elex_luca-stealer
-
Size
332KB
-
Sample
250422-qdrlqsznw9
-
MD5
588b20c2228a04d7e38d165197e17c33
-
SHA1
80889b9cf8a45e3676f5e540bd905504fe1ff1dd
-
SHA256
9e245ac611d0c3115922c0115e9307245f402062d8306dd06d5d121b05d1776f
-
SHA512
87c1ed70e5658e6ccfa6c7caa85f347e84babda9c5aac3f9afd8d70e2524ae45b92b50028fb08817b037ac66a0ad572c667ee0a10dc4d5e404fc855e85803a1d
-
SSDEEP
6144:iq9ezqsEC8dS7CCKUf+9xwL1ZTcDCzyrxQX3hVds+tfCOu3miq/R8iXq:i4JsE3CKUf+9xwL15cDCzie1ChALXq
Score
10/10
Malware Config
Extracted
Path
C:\98e9ea07f139e046c8\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">Z4oeDbtG1dT9R6/2SISWemnA4rByrmIIM0sUk+QT4s34UuV7yIPDDJWhBup5IxFnQ+FEnvnNvFHNyH1R6PDPxQTWFgR4p9IWeLLx8kMIEUmgZSz3cQbBLLVowXFN+g7z4uKK8qiz0E3TcVv15RHjfQthT/2t7aFWa1I+mVLyZR7cua4jUGhRqZflnyS7jH7jt4oWmxjAP+0yBWivtk6UOHkr8UOJ+LA6Pi7LSQs2XnDxUkqWSQ/vM9YD9UhwxVXwm+nUAhsKgR9cdSxvguAdFADdHhkX8Ak9JxEdYrJoRzCPE/RWUDUObWWjrJ2usLl3eelUgnCLF7/LWjC8NEcOgyhbY+U57j6DEWRT6GTe7BgDLx8YZ3rS7TKc8bH6XvPfPCmwo5Bbsz6IS2eJ2sbjh2GLAQQ02ZvpejbC2/D9sdCVFHuEErUEe2bzKJ6COxdqhdubOwf7Vo4qk9ZG0POR4ZuepMhPafXaodzDJD0MhFmwMTQJ/PLCBz9p4PuDmEMBl+y+9Dt9qjEI8NOYdAEpz/jr4KnyW1uzFkN05mfX1bQkFpzJ90dsHl7AuyhmuWi8ii10wMMo/pjMJRK6Onp90PxDWHVqu6nn+VI+NLOyEyohVbWbQsCdUYGZ1wvtKCa5BAFixc4Cvn01CC4//f3edUcoyEmop8M4F/uRb9ud3T8cgBxFWQnaQf2l0jvNcFtL1Xy2uMfFJUTAex+yJd7r5H0Od7UB8VNS6OftdUqlOli1bd0z61Bnr/U3lRPKATJBVz9ttUs3p0+BZU8aVHebNDE1fyldGtULTz9PJZzDtGS9WytbC90sbAHzNSeN9sOEUJnmmVGICUvd8lgrqpS9gK4stIbJk+O91uPvoSdXaB6+HlIIF+s6ClV9jCGgG7drplrz7Kx/4clRpns9lT0sc7HOsEwN2E9yI1rVRwyL+a+mdkiDt3guEb3jeNxiNOG3psbBVyROJVS+TonlQcxbd+PCc075SRoiJDVFJvuw32m0l3SiOBKNz+bo+QUslCesPeBRCOaG0242Z5WcC0KqKQTI9WVfebDiU6oIm7UvZWDMben5LSEPtJ3nMBXRoFDAla8y8rxJfvt6ooKjlrTpwoQu1OKV14Y4ZmR1wfZqtAsf0GNicdyDTqkBHXqOb0aNsOVfITAay3/t/DM/FswaD4mZpok9QtZEyYs7M9eM1xwOyXv11k0W4R/I2V1CtN9JDQMjnS1EMbHJMyOjtP7ssTL+TOzua60tpqZHyDI7p5UjgHLKNysofUeZuF/k24yg4V9bTUl2vVVgqrFuFTd0SealbFYO8E+Y8Fg6+V4F/ECuO3PALznuXrSrA4BtKR/U9Ft2FP7WLmNiGQr46KIfWPAu5sKGTQR6mk70fPYY/2hdE0C02ULY4bqgH2RxJrxnFN5Z+CCSSJDpOWkKzGXmyS+R6wKH97nU7UjwGDnggHEZN8Aeq/QcpRH+ZE/hAKkD5etQqU/J0YBNRYB3HLBdUPtjBBWXPy/aN7KPbFsiI42ieSaecBRLnWdSTIN/RVPMH42qpgAU/j8ZkrkQKDzPMc4KInbEzmKYHddyDzEL3oJdjTHh6oquNSTDk0NBkezbfCXC83xI6sNegcnbo1gdKINzHdfpcicikYognt7CyaRR7rLcjFV12LYNu8PlXZkG+U08tDL+hkPlVG3CjuXapvRCVI1jA/B5SaysblHaiEk=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] "> [email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\96b4ed9c1ec205c2a0fbf7b228cf45\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">SBENEUpuN6p7Z8/BWQn3CHqCB14kg2UBZ5v5nvgyxhy/3p2S+lYC6VQ7/Bnw/G2NTi2POKmrUsuzGljzJwWXaEFU8dPjMrJ4hpmADzBfE/KuciLQgCLWzAi1oKWkKhsiCsRvDyuCMAjsErJAwrnOrkdjrPnQbA/LYquRa+rCZoYog+P3MfLcM9kM+KTBOTgi+VCim1qM+uQ7OKirkDhVKqIPcfMtyG0aw0HrN9Vsy99edIuo3Pd4Szm/GcHJ1tx4zpDcIXN+NFXiBF/PWlgEXtzJJ8LLbbSMKx3aeht6I9IYOHAuTslCxv/yXxmpcUOuWyRhpLq3HYQIhej347rCVqGVTbvwjqATXNHgI9P4bfdwc23pm0nMiv1uqDErZCL5yVx1p4vl3EEaq/PKn8ksd71sLdiaGe0IqksJeFCmiJrYlYfjYvoxXFLu9BzuTCh27hvmi191BUXVPeyplbtoeqSrcZaCQ8NAzB+Ftf6siE//pBEjgGtDibu1hQpeYm3/sEvbPeOuqK11xDfvSZgl2G/230Tr8kwyn64p9hj2o0HWZmG/fgFp9lAepardlUJk+eLCsqtC4pIjNEnzxVMXydTbWCSMTrXWIhzOCfc4HGCWihxb76MlHCGf1vEfr7D+okBcEVm85BAPT/+ouZw/RhUMrdC4bd6fu/H9hKB3E7igv1xlfu40iP76ayW3qity3Kkj/L/IdisGUsYyfyNd2w3VCfK8/URxiXTe0eVy28xCwkoZQosWLhOjPlui5AEFDojMzqDYFvdLAbNwGgRqF/JbgxO6DXl6H0pBPSXS1EnnVGUMttkPSoTC+JY2KUXWuKUh17gN2jhRseeMjGVhuPNmNCQBVFMJ7w6lyzzmNXqlhn/E2djHQDtbyaeJ4Zitv00ovvJiMw0T7oTR4BwENz1oBTQmDoysQbEdNvilMQ391Uj+IpxV8NuoGU6u9oLUTYqPGLltaeKpQjZ4R1VZdeNN7GuXhJEp74B391akJgrBhVejE8c+R/RqxArZvLghBc8h0JMsJLfqbtCDrohn5+1Hg9p+S9qwzkSNSHRZLI9EhKJ14dafH45daFSRO+Pnfi3v51BRrABX2kawvtCGO2wE5Lup6MeI7aK7CoJOaDnMmzCD1DYFjtGr4cRY2Zq4jE2p+/Jwtw+GVZQ2g5PRF8hAIdXZRrKKFEOkWV6tFlJ4i5MEi0ofLyiau3izab09vyfHZyHho3AZwABfedx5bgZ6wa4/jRdI4l09ZerISLKB8ED1a/uTUEXN8zuyKIA3vLRJuf22fbrZn8k2Qa13sSYNykB3HdnGRrAHjRE3VLEiR3CUCEWQwCtyH4ktOgDgJjRE6mfMGqA8WWQnZtxIjJHVFiAVwEUnnIHE8JC5WlQn2dkgWglv6/toTLypVTsAvvbsq36qigMzcBxutAftYxq1gzU+vRWVCOpEx/PMNzhmthPrXtq9F0H4P/X3w+y7tXvv1xrcH98QI95wwo/MWl7QLB8Dp0H4MSAxMLCOztqepZ2V2isWfEWECv9MSYzLw7r1XwkrxVw3/uetO8gEuiKDJCN5NRhp7xG160Y1suVpk7gNtdiZTMs+TswCxp88zBNi2cOt0Cfnw1cDlmRMUoPNhJiUNs/1Qaqbx7oGY9z+eqLJ0PCklwlpPQxtZyQigNo0kNUhiEqpa30TFhKEw4Xy6zz+UzLZCc4D20JnUmk=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] "> [email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
2025-04-22_588b20c2228a04d7e38d165197e17c33_black-basta_cobalt-strike_elex_luca-stealer
-
Size
332KB
-
MD5
588b20c2228a04d7e38d165197e17c33
-
SHA1
80889b9cf8a45e3676f5e540bd905504fe1ff1dd
-
SHA256
9e245ac611d0c3115922c0115e9307245f402062d8306dd06d5d121b05d1776f
-
SHA512
87c1ed70e5658e6ccfa6c7caa85f347e84babda9c5aac3f9afd8d70e2524ae45b92b50028fb08817b037ac66a0ad572c667ee0a10dc4d5e404fc855e85803a1d
-
SSDEEP
6144:iq9ezqsEC8dS7CCKUf+9xwL1ZTcDCzyrxQX3hVds+tfCOu3miq/R8iXq:i4JsE3CKUf+9xwL15cDCzie1ChALXq
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (7203) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-