General
- Target 2026-06-28_2f46f5688188184d8659d7e0acfa5552_akira_alphv_blackcat_elex_glassworm
- Size 2.9MB
- Sample260628-3j3bmsgv9z
- SHA256 ed3eb4d9b6e609b06f71bbbee3a3bab1fe68920276b15e0e128e080f8294d049
Malware Config
Extracted
-
blackcat
-
Username
Administrator
-
Password
Vivit5on0640
-
Username
Administrator@FAIRWAY
-
Password
Vivit5on0640
-
Username
admin
-
Password
Onegl@ss2020
-
enable_network_discovery
true
-
enable_self_propagation
true
-
enable_set_wallpaper
true
-
extension
hat2gck
-
note_file_name
RECOVER-${EXTENSION}-FILES.txt
-
note_full_text
----Welcome to the Black Cat Ransomware----- Failure to contact us, will result in higher costs at every level for you. And all you / your customers files. >> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your network was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: -Customers financial info -Your financial info with LLoyds and any other banks. -Invoices. -All the emails database - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://cmzh4nkisvkvyxc6o25ympbq52xphnexikkto5fyx52saaaxfv7piuyd.onion/?access-key=${ACCESS_KEY}
Targets
-
- Target 2026-06-28_2f46f5688188184d8659d7e0acfa5552_akira_alphv_blackcat_elex_glassworm
- Size 2.9MB
- SHA256 ed3eb4d9b6e609b06f71bbbee3a3bab1fe68920276b15e0e128e080f8294d049
Score10/10-
Family: BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Detects command variations typically used by ransomware
-
Detects executables containing commands for clearing Windows Event Logs
-
Detects executables containing many references to VEEAM. Observed in ransomware
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.