General
- Target 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom
- Size 2.5MB
- Sample250512-cx3lfsdm7x
- SHA256 5e88f40a24f42507f85ce180214db231354e8603fb0133f7d612184a5b41b227
Score
10/10
Malware Config
Extracted
Path
-
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\RecoverYourFiles.txt
Ransom Note
- =========================================== DECRYPTION ID: 3Y49O85TYLYU8TLO5NYUL5JU8LU =========================================== ====================================================================== ======== ALL YOUR FILES HAVE BEEN ENCRYPTED ====================== ====================================================================== If you are reading this, your system has been compromised. all your important files are SECURLY LOCKED ,including: . Documents . Photos . Videos . Music . Databases . Archives . Projects etc... We are not politically motivated, our motivations are purely financial. we are an independent group of security professionals. we have no ties to any government or entity. ===================================================================== ================= HOW TO DECRYPT YOUR FILES ===================== ===================================================================== ( OPTIONS 1 ): 1. Download Tor Browser from here, and connect to the onion network: https://www.torproject.org/download/ 2. Contact our support team BEFORE THE DEADLINE at this onion link: https://ghe678ihyi8khy8kh5rt87ku8tg34sh5tecvjbkramlkgmjhlkergh8423yumtghw8543mulyb5m.onion 3. Send your DECRYPTION ID mentioned at the top of this file. 4. Our team will respond for negotiation and payments ( OPTIONS 2 ): 1. Download Session Messenger from here: https://getsession.org/ 2. Contact our support team at this Session ID: g58675t7ug57u43dyethdb53dhg7u6t7juf3542s3ecjkvutju 3. Send your DECRYPTION ID mentioned at the top of this file. ===================================================================================== ==================== CONTACT DEADLINE : 48 HOURES ================================= ===================================================================================== After the 48 hour deadline your ONE-TIME decryption keys WILL BE AUTOMATICALLY DISTROYED DO NOT attempt to rename, move, or tamper with encrypted files. Any such actions may result in irreversible data loss. -> DO NOT TRY TO DECRYPT THE FILES USING FREE OR COMMERCIAL TOOLS -> THESE TOOLS WILL ALTER THE FILE STRUCTURE AND IT WON'T BE RECOVERABLE -> OUR ENCRYPTION TECHNIQUES ARE SECURE, DONT BOTHER TRYING :D -> WE WILL NOT GUARANTEE DATA RECOVERY IF THE FILES ARE MODIFIED IN ANY WAY ===================================================================================== ========================== DECRYPTION PROOF ======================================== ===================================================================================== . We provide a sample decryption to prove that your files are recoverable . Send one of your files ( size < 100 MB ) that doesn't contain any important info . We will send you a decrypted sample immediately . We will guarantee one-time decryption and you won't be targeted by us ever again - The Desolated Collective
URLs
-
https://ghe678ihyi8khy8kh5rt87ku8tg34sh5tecvjbkramlkgmjhlkergh8423yumtghw8543mulyb5m.onion
-
https://getsession.org/
Targets
-
- Target 2025-05-10_f16b85de0d4cc0807dfecd16069e742b_black-basta_cobalt-strike_satacom
- Size 2.5MB
- SHA256 5e88f40a24f42507f85ce180214db231354e8603fb0133f7d612184a5b41b227
Score10/10Renames multiple (811) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)
Sets desktop wallpaper using registry