Banta Ransomware

Banta ransomware is part of the Phobos ransomware family, which has been responsible for numerous attacks over the years. Banta is developed in .NET language and uses AES encryption.

Banta acts as a Trojan horse to break into the victim’s system, the file is downloaded through emails, pirate download sites and others.

The file, apparently, looks normal, but the ransomware is hidden in it and once it is downloaded, the ransomware installs itself and starts disabling programs that could interrupt the encryption process.

The ransomware can target Databases, Servers, Storages, Virtual Machines, RAID systems, these are the main targets of the group.

Through encryption access to data is blocked preventing the opening of files, the extension .banta is added to all affected files.

After encryption is completed, a file is created and placed on the desktop, where the victim’s information is recorded so he or she can contact the criminals to pay the ransom.

The payment is made through cryptocurrencies, because they are practically untraceable. The e-mails used by the group are “bytens@cock.li and backuping@protonmail.com”.