Overview

overview

10

Static

static

3

e4c2e0af46...in.exe

windows10-2004-x64

10

e4c2e0af46...in.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    13/03/2026, 17:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b.bin.exe
  • Size 12.1MB
  • Sample260313-vxtbwsey4v
  • SHA256 e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
blacksnakepersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Default\UNLOCK_MY_FILES.txt

  • blacksnake

Ransom Note
  • Your important files are encrypted. If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service. We guarantee that you can recover all your files safely and easily. All you need to do is submit the payment and purchase the decryption software. Please follow the instructions: 1. Send $20 USD worth of Bitcoin to following address: bc1qu7f2m5r7al0fmank5mkq0xju3z3rkdvj778v45 2. Send the transaction ID to [email protected] with the subject 'TX ID' (In case of no response in 24 hours contact us via the email addresses listed bellow) 3. The decryption software will be sent to you within 48 hours. OUR ALT EMAIL ADDRESSES: [email protected] [email protected] [email protected] [email protected] Please note that it may take longer for us to respond if the demand of our services is high, we'll try to contact you as soon as possible, just be patient please. If our email addresses get suspended we will provide updated information in the following site so we can stay in contact with our clients. http://torpastezr7464pevuvdjisbvaf4yqi4n7sgz7lkwgqwxznwy5duj4ad.onion/raw/t8st1gRNbg6ea2D7UQJq/ IMPORTANT: YOU NEED TO INSTALL TOR BROWSER IN ORDER TO VISIT .ONION SITES DOWNLOAD IT USING THE FOLLOWING LINK: https://torproject.org - FAQ - There isn't another way to unlock my files? No, the content of your files is encrypted using AES-256 and RSA-2048 cryptographic combination, nobody can unlock your files without the private key, please avoid using third-party software to decrypt your files, only us have the private key and we are the only who can recover your files. How can i be sure that, if i pay, i won't be scammed? We really care about our reputation, and to prove we can help you decrypt your files, you can send us ONE of your encrypted files (NOT BIGGER THAN 5 MB, WE ARE NOT RESPONSIBLE IF THE FILE CONTAINS ANY PERSONAL INFORMATION) and we will decrypt it for free. How can i get Bitcoins and what is a Bitcoin transaction ID? Do some research, there is plenty of information about this on the internet. If you can't find the answer to your question then contact us to the email address bellow, we'll prioritize clients who are having ACTUAL ISSUES submitting the payment. [email protected] - IF YOU HAVE QUESTIONS SEND THEM TO THIS EMAIL, WE WILL IGNORE QUESTIONS SENT TO ANY OTHER EMAIL ADDRESS. WARNING: DO NOT TRY TO DECRYPT MANUALLY OR USING THIRD-PARTY SOFTWARE, YOU CAN CORRUPT YOUR FILES AND THEREFORE NOT EVEN US WILL BE ABLE TO DECRYPT THEM.
URLs

  • http://torpastezr7464pevuvdjisbvaf4yqi4n7sgz7lkwgqwxznwy5duj4ad.onion/raw/t8st1gRNbg6ea2D7UQJq/

Signatures

  • BlackSnake

    BlackSnake is a Windows ransomware.

    ransomwareblacksnake
  • Blacksnake family
    blacksnake
  • Renames multiple (292) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b.bin.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\UNLOCK_MY_FILES.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:5316
  • C:\Users\Admin\AppData\Roaming\svchost.exe
    C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: AddClipboardFormatListener
    PID:6032

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b.bin.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b.bin.exe.log
        • Size 1KB
        • SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svchost.exe
        • Path C:\Users\Admin\AppData\Roaming\svchost.exe
        • Size 12.1MB
        • SHA256 e4c2e0af462ebf12b716b52c681648d465f6245ec0ac12d92d909ca59662477b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Administrative Tools.lnk
        • Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools.lnk
        • Size 1B
        • SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
        • MD5 SHA1 SHA512
        Submit Download

        UNLOCK_MY_FILES.txt
        • Path C:\Users\Default\UNLOCK_MY_FILES.txt
        • Size 2KB
        • SHA256 5e93c81c90c2053f4d0db8dc4af5e1edd714ec54fea52bf7dc6168f8a360f3a2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1052-0-0x00000000000F0000-0x0000000000A8A000-memory.dmp
        Download

        memory/1052-1-0x000000001B660000-0x000000001B670000-memory.dmp
        Download

        memory/1052-16-0x0000000001280000-0x000000000128C000-memory.dmp
        Download

        memory/2436-286-0x00000000017F0000-0x00000000017FC000-memory.dmp
        Download

        memory/6032-1490-0x000000001BDA0000-0x000000001BDAC000-memory.dmp
        Download