Skip to content
MalwareWiki

Malware

win.beast

aka blacklockbit

Beast is a Ransomware-as-a-service (RaaS) product which provides functionality such as SMB scanning, file encryption, service and process starting and stopping, and geographic identification to avoid

win.beast, also known as blacklockbit, is a Windows malware family.

Background

Beast is sold as a Ransomware-as-a-service (RaaS) offering. Its capabilities include scanning SMB shares, encrypting files, starting and stopping services and processes, and detecting the host's geographic location so that machines in CIS countries are left unencrypted.

Source: Malpedia (Fraunhofer FKIE).