Payouts King is a double-extortion ransomware operation that ThreatLabz attributes to former BlackBasta affiliates. BlackBasta emerged in February 2022 as a Conti successor and operated until February 2025, when leaked internal chat logs forced the brand to disband. Its initial access brokers continued operations, and Payouts King first appeared in April 2025. By early 2026 the group had claimed 50+ named victims, with the United States the largest share followed by Germany, France, and Spain. Initial access mirrors historic BlackBasta tradecraft: email spam bombing, Microsoft Teams impersonation of IT help desk, and abuse of Quick Assist for remote access.

The core of this analysis is the Windows payload's EDR-evasion engineering. Rather than calling documented Windows APIs (which security products hook in user mode), Payouts King resolves and invokes native NT syscalls directly. At runtime it walks the loaded ntdll module's export table, enumerating function names beginning with the 'Zw' prefix, and computes a custom CRC32 checksum (polynomial 0xBDC65592, per-value FNV1 seed) for each name, matching against expected DWORD constants to locate the functions it needs — including ZwQueryInformationFile (0x806e69a7), ZwQueryInformationProcess (0x1993a634), ZwOpenProcess (0x58ad11ee), ZwTerminateProcess (0x469424d5), ZwOpenFile (0x28a29ebf), and ZwQuerySystemInformation (0xa0595508). This yields a private syscall table that bypasses user-mode API hooks.

Process termination uses the same checksum technique: the binary carries 131 hardcoded DWORD checksum values representing AV/EDR and security tooling. It enumerates running processes via ZwQuerySystemInformation, checksums each process name, and terminates matches via ZwOpenProcess + ZwTerminateProcess. Documented targets span CrowdStrike (csfalconservice.exe), SentinelOne (sentinelagent.exe, sentinelctl.exe, sentinelui.exe), Microsoft Defender (MsMpEng.exe, MsSense.exe), Kaspersky (avp.exe, avpui.exe), Norton, McAfee, Cylance, Cybereason, Deep Instinct, F-Secure, and 100+ additional products.

String obfuscation defeats static signatures and precomputed hash tables: strings and their XOR keys are stored as stack-based arrays of QWORDs, constructed and decrypted in-place at runtime, leaving no plaintext in the on-disk image. The custom CRC32 with unique FNV1 seeds per value further frustrates hash-database lookups.

Encryption is hybrid: a per-file pseudorandom 32-byte AES-256 key and 16-byte IV encrypt file data in CTR mode using statically linked OpenSSL; the per-file parameters are then RSA-4096-encrypted and appended as a 487-byte trailer. The encrypted trailer carries magic bytes 'CRPT' (0x50545243), an encryption-type field (0x825456 for AES), original/encrypted sizes, and a block count (1 = full encryption, 0xd = 13-block partial). Selective encryption: files matching a target extension list or under 10MB are fully encrypted; larger files are split into 13 blocks with ~50% of each block encrypted, controllable via the '-percent' CLI parameter. Executables and system artifacts (.exe, .dll, .sys, .bat, .lnk, .msi) and system directories (Windows, Program Files, Recovery, $Recycle.Bin) are excluded to preserve host stability.

Encrypted files receive the .ZWIAAW extension, with .esVnyj used as a temporary backup during processing. The ransom note readme_locker.txt is dropped to the desktop only when the '-note' CLI flag is supplied; it directs victims to a TOX contact and a Tor-hosted data leak site that publishes victim names with countdown timers and progressive data disclosure. Pre-encryption, the malware performs anti-recovery actions: shadow copy deletion, Windows event log clearing, and recycle bin emptying.