BlackByte Ransomware (.blackbyte) Support Topic

Any files that are encrypted with BlackByte Ransomware will have the .blackbyte extension appended to the end of the encrypted data filename and typically will leave files (ransom notes) named BlackByte_restoremyfiles.hta as explained here by Amigo-A (Andrew Ivanov). 
 
Trustwave has released a decrytor allowing past victims to recover their files for free.

• BlackByte ransomware decryptor released to recover files for free
• Trustwave has made a BlackByte decryptor available for download at GitHub

 
 
Hello, 
 
We are facing with a new ransom named "Blackbyte"
 
We don't find any information about that, in google, duckduckgo or dark web.
 
 
Anyone has more details? 
 
BlackByte: "HELLO!"
your network has been hacked
 
Your documents, and databases encrypted 
To decrypt your files, you need to purchase our decryptor. 
To decrypt files, follow the instructions below.
 
FULL INSTRUCTION
1) Email us: blackbyte1@onionmail.org
2) Your domain should be in the email header
3) The body of the letter should contain the key given to you in the note.
4) If you do not write to us within the next 3 days, your details will be posted on our auction.
5) To prove that we can decrypt files, we can decrypt 2 files for free, it should be no more than 3 MB and should not contain important information.
6) Don't use 3rd party software to try decrypt your files, you can cause damage and even we won't be able to restore them.
Our auction is available here: 6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion, for access use Tor Browser
 
Your key 
xxxxxxxxxxxxxxxxxx.

Edited by quietman7, 15 December 2024 - 12:51 PM.

we also faced with blackbyte.

Hello, andgx

Hello, thomascnk

Put the 'BlackByte_restoremyfiles.hta' file in the archive with the password 'note123' and attach it to the forum message.

Some antiviruses, cloud services and forum protection can delete the hta file as dangerous. 

Therefore, it must be archived with a password.

You can also transfer the file through a sharing site, For example, this https://dropmefiles.com/

Just drag the file to the site, do not enter any addresses or contacts. 

Edited by Amigo-A, 20 July 2021 - 06:44 AM.

Likely new, only seeing two IPs submitted to ID Ransomware so far. Need the malware executable to analyze.

do u have sql files , virtual image files or compressed files to needed?

Likely new, only seeing two IPs submitted to ID Ransomware so far. Need the malware executable to analyze.

Malware maybe the script file (obamka.js), run with the help of wscript.exe. It has self destroyed function and run as scheduled task.

 I uploaded the sample encrypted file and ransom note.

https://www.mediafire.com/file/gmccf0gard6yhzr/BlackByte.rar/file

Edited by MyoMyintHtike, 18 September 2021 - 09:33 AM.

Dear MyoMyintHtike

If you have the opportunity to upload files from the screenshot (highlighted with a red line), then put them in an archive with a password (your login on the forum) and give me a link to PM using the exchange site.

Edited by Amigo-A, 19 September 2021 - 04:33 AM.

Topic title changed to reflect naming convention and direct other victims to this support topic.

Dear MyoMyintHtike

 

If you have the opportunity to upload files from the screenshot (highlighted with a red line), then put them in an archive with a password (your login on the forum) and give me a link to PM using the exchange site.

Threat actors deleted obamka.js file in all servers.

Fortunately, I got obamka.js file from one AD Server.

I uploaded and sent to you. Please check PM. (In attachment file, the autorun file (.arn) already included)

I downloaded it, thanks.

JS loader is unfortunately not supported. Need to use a real PC online.

Hi!

From a computer that was encrypted by BlackByte I got an "1709.exe" with an icon of Mr.Death, is that something that will help you to investigate this ransomware?

Also on this Computer I can see a lot of processes "wordpad.exe /p c:\bb.dll" all startet by an invisible cms process.

There is one additional thing that makes me wonder, there are a lot of large files encrypted within the same minute on an slow attached NAS, so that is looks as there were only some bytes written to the beginning, or the end of the file, is that possible

Regards

is that possible

 

Yes, it is possible. It will be nice if a lot of files are not encrypted or damaged.

Edited by Amigo-A, 21 September 2021 - 04:50 AM.