Overview

overview

10

Static

static

10

2026-03-11...at.exe

windows10-2004-x64

10

2026-03-11...at.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-03-11_d73ae11bce66eef317ca2368ac5df3cb_amadey_black-basta_cobalt-strike_elex_glassworm_luca-stealer_lynx_njrat
  • Size 543KB
  • Sample260311-pdx8vaev7t
  • SHA256 589c680633143e149e53df914cd72075cbe98cd53ac35ac3311a5710aaee9d93
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
blackbastacredential_accessdefense_evasiondiscoveryexecutionimpactransomwarestealer

Malware Config

Extracted

Path

  • C:\Program Files (x86)\readme.txt

Ransom Note
  • Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/ Your company id for log in: ba7a7058-3531-4b67-bae6-d602e9110361
URLs

  • https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/

Targets

    • Target
      2026-03-11_d73ae11bce66eef317ca2368ac5df3cb_amadey_black-basta_cobalt-strike_elex_glassworm_luca-stealer_lynx_njrat
    • Size 543KB
    • SHA256 589c680633143e149e53df914cd72075cbe98cd53ac35ac3311a5710aaee9d93
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionblackbastaimpactransomwarecredential_accessstealer

    • Black Basta

      A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

      ransomwareblackbasta

    • Blackbasta family

      blackbasta

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (2569) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks