Overview

overview

10

Static

static

10

360758c296...e8.exe

windows10-2004-x64

10

360758c296...e8.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.bin
  • Size 1.8MB
  • Sample250925-sajstsbp2v
  • SHA256 360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
blacknevashunters_internationalransomware

Malware Config

Extracted

Path

  • C:\how_to_decrypt.txt

  • hunters_international

Ransom Note
  • ATTENTION!!!! Your computer ID: AHN BIOTECHNOLOGIE GMBH ATTENTION to representatives AHN BIOTECHNOLOGIE GMBH!!!! Your system has been tested for security and unfortunately your system was vulnerable. We specialize in file encryption and industrial (economic or corporate) espionage. We don't care about your files or what you do, nothing personal - it's just business. We recommend contacting us as your confidential files have been stolen and will be sold to interested parties unless you pay to remove them from our clouds and auction, or decrypt your files. Your computer ID: AHN BIOTECHNOLOGIE GMBH Please note that if: - you ignore this message for 7 days, your decryption keys will be deleted; - an attempt to change the name of an encrypted file will damage the encrypted file, making it impossible to decrypt; - using third-party free or paid programs will damage the encrypted file, making it impossible to decrypt; For more detailed information write to us: [email protected] Telegram: https://t.me/BlackNevas Reserve Email: [email protected] and [email protected] Your computer ID: AHN BIOTECHNOLOGIE GMBH ATTENTION to representatives AHN BIOTECHNOLOGIE GMBH!!!! If you ignore or refuse to cooperate, we will be forced to hand over your stolen data to our partners for publication in a data leak blog and further sale at auctions. To open .onion sites you need to download the TOR browser https://www.torproject.org/download/ or the multifunctional browser Brave https://brave.com/download/ new private window Tor. Find your details on these sites of our partners: http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion/companies http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog http://black3gnkizshuynieigw6ejgpblb53mpasftzd6pydqpmq2vn2xf6yd.onion http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion http://k67ivvik3dikqi4gy4ua7xa6idijl4si7k5ad5lotbaeirfcsx4sgbid.onion Your computer ID: AHN BIOTECHNOLOGIE GMBH
URLs

  • https://t.me/BlackNevas

  • https://brave.com/download/

  • http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion

  • https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion/companies

  • http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog

  • http://black3gnkizshuynieigw6ejgpblb53mpasftzd6pydqpmq2vn2xf6yd.onion

  • http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion

  • http://k67ivvik3dikqi4gy4ua7xa6idijl4si7k5ad5lotbaeirfcsx4sgbid.onion

Targets

    • Target
      360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.bin
    • Size 1.8MB
    • SHA256 360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    blacknevashunters_internationalransomware

    • BlackNevas

      BlackNevas is a cross-platform ransomware related to the Trigona family.

      ransomwareblacknevas

    • Blacknevas family

      blacknevas

    • Detects Windows variant of BlackNevas ransomware

    • HuntersInternational, Water Ouroboros

      HuntersInternational aka Water Ouroboros is a ransomware that operates under a Ransomware-as-a-Service model.

      ransomwarehunters_international

    • Hunters_international family

      hunters_international

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks