BlackLock Ransomware Deep Dive: A Cross-Platform, Double Extortion Threat

Malicious File Summary

Sample Analysis

Summary

The sample requires administrator privilege to execute and must be run via the command line; it does not launch via double-click.

Upon execution, the following log is printed:

Ransom note content：HOW_RETURN_YOUR_DATA.TXT

Example of encrypted files:

Analysis

Windows Version

Supported optional parameters for execution:

When provided with appropriate user credentials, it can encrypt files on shared networks using the SMB protocol.

Logs are transmitted via WebSockets to 173.44.141[.]152, with the Origin header set to “http://logger”

To eliminate traces, the Eldorado ransomware runs a PowerShell command to overwrite the encryptor executables with random bytes and then deletes the file. If the “-keep” parameter is specified, this action is skipped:

$f=; 
while(Test-Path -Path $f) 
{ 
$o=new-object byte[] 10485760; 
(new-object Random).NextBytes($o); 
[IO.File]::WriteAllBytes($f,$o); 
Remove-Item -Path $f; 
Sleep 1; 
}

Linux Version

The Linux variant is simpler, supporting only the -path parameter.

It recursively encrypts files within the specified directory using the same encryption algorithm as the Windows version.

Indicators of Compromise (IOC)