BlackSuit Ransomware Dissection

Researchers have discovered a new ransomware family called BlackSuit, targeting both Windows and Linux users. It shares the similarities with the notorious Royal ransomware, which suggests it may be a new affiliate or reuse of Royal’s source code.

Researchers share the findings after analyzing a Windows 32-bit version and an ESXi 64-bit version of BlackSuit, and it appends the file extension .blacksuit to encrypted files and leaves a ransom note that includes information about the attack, a unique ID for the victim, and a TOR chat site link for communication.

The malware operators use a data leak site to post leaked data in case a victim does not pay the ransom. Although, as of now, this leak site shows just a single victim.

BlackSuit’s YARA rule matches the samples of the Royal ransomware. Further digging revealed that the two malware have many similarities.

BlackSuit supports the use of several command-line arguments, which are similar to those used by Royal with additional commands thats unique. Both malware use comparative intermittent encryption techniques, including OpenSSL’s AES encryption algorithm and similar formulas and numbers when comparing file size.

The source code used in the 64-bit samples of the two malware, there is a 98% similarity in used functions, 98.9% in BinDiff-based jump statements, and 99.5% in blocks. The code used in 32-bit samples exhibits 99.3% resemblance in basic blocks, 93.2% in used functions, and 98.4% in jumps based on BinDiff.

Although BlackSuit has not publicly called out its connection with the Royal ransomware, researchers suspect this to be either a new variant developed by the same malware authors or a copycat group using Royal’s code with its own branding.

This research was documented by researchers from Trend Micro

Indicators of Compromise

• 90ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c
• 1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e
• 6ac8e7384767d1cb6792e62e09efc31a07398ca2043652ab11c090e6a585b310
• 4d7f6c6a051ecb1f8410243cd6941b339570165ebcfd3cc7db48d2a924874e99
• b57e5f0c857e807a03770feb4d3aa254d2c4c8c8d9e08687796be30e2093286c