# Payouts King Ransomware — BlackBasta-Affiliate RaaS Evades EDR via Direct System Calls, ntdll Export-Table Walking, and SetFileInformationByHandle Rename Evasion (Zscaler ThreatLabz)

> Zscaler ThreatLabz published a binary-level analysis of Payouts King, a data-theft-driven ransomware operation run by former BlackBasta affiliates (BlackBasta disbanded Feb 2025; Payouts King first observed April 2025). The payload evades AV/EDR by issuing low-level direct system calls — walking the ntdll export table for Zw-prefixed functions and resolving syscall stubs via a custom CRC32 (polynomial 0xBDC65592) rather than hooked Windows APIs. It targets 131 hardcoded checksum-matched AV/EDR processes, builds and XOR-decrypts strings on the stack at runtime, and renames encrypted files via SetFileInformationByHandle (FileRenameInfo) instead of MoveFile to bypass rename heuristics. Encryption is hybrid RSA-4096 + AES-256-CTR using statically linked OpenSSL, applied selectively to maximize impact and minimize detection.

- **Published:** 2026-06-06T00:00:00Z
- **Last reviewed:** 2026-06-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0692
- **ID:** TL-2026-0692
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Payouts King
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Payouts King is a double-extortion ransomware operation that ThreatLabz attributes to former BlackBasta affiliates. BlackBasta emerged in February 2022 as a Conti successor and operated until February 2025, when leaked internal chat logs forced the brand to disband. Its initial access brokers continued operations, and Payouts King first appeared in April 2025. By early 2026 the group had claimed 50+ named victims, with the United States the largest share followed by Germany, France, and Spain. Initial access mirrors historic BlackBasta tradecraft: email spam bombing, Microsoft Teams impersonation of IT help desk, and abuse of Quick Assist for remote access.

The core of this analysis is the Windows payload's EDR-evasion engineering. Rather than calling documented Windows APIs (which security products hook in user mode), Payouts King resolves and invokes native NT syscalls directly. At runtime it walks the loaded ntdll module's export table, enumerating function names beginning with the 'Zw' prefix, and computes a custom CRC32 checksum (polynomial 0xBDC65592, per-value FNV1 seed) for each name, matching against expected DWORD constants to locate the functions it needs — including ZwQueryInformationFile (0x806e69a7), ZwQueryInformationProcess (0x1993a634), ZwOpenProcess (0x58ad11ee), ZwTerminateProcess (0x469424d5), ZwOpenFile (0x28a29ebf), and ZwQuerySystemInformation (0xa0595508). This yields a private syscall table that bypasses user-mode API hooks.

Process termination uses the same checksum technique: the binary carries 131 hardcoded DWORD checksum values representing AV/EDR and security tooling. It enumerates running processes via ZwQuerySystemInformation, checksums each process name, and terminates matches via ZwOpenProcess + ZwTerminateProcess. Documented targets span CrowdStrike (csfalconservice.exe), SentinelOne (sentinelagent.exe, sentinelctl.exe, sentinelui.exe), Microsoft Defender (MsMpEng.exe, MsSense.exe), Kaspersky (avp.exe, avpui.exe), Norton, McAfee, Cylance, Cybereason, Deep Instinct, F-Secure, and 100+ additional products.

String obfuscation defeats static signatures and precomputed hash tables: strings and their XOR keys are stored as stack-based arrays of QWORDs, constructed and decrypted in-place at runtime, leaving no plaintext in the on-disk image. The custom CRC32 with unique FNV1 seeds per value further frustrates hash-database lookups.

Encryption is hybrid: a per-file pseudorandom 32-byte AES-256 key and 16-byte IV encrypt file data in CTR mode using statically linked OpenSSL; the per-file parameters are then RSA-4096-encrypted and appended as a 487-byte trailer. The encrypted trailer carries magic bytes 'CRPT' (0x50545243), an encryption-type field (0x825456 for AES), original/encrypted sizes, and a block count (1 = full encryption, 0xd = 13-block partial). Selective encryption: files matching a target extension list or under 10MB are fully encrypted; larger files are split into 13 blocks with ~50% of each block encrypted, controllable via the '-percent' CLI parameter. Executables and system artifacts (.exe, .dll, .sys, .bat, .lnk, .msi) and system directories (Windows, Program Files, Recovery, $Recycle.Bin) are excluded to preserve host stability.

Encrypted files receive the .ZWIAAW extension, with .esVnyj used as a temporary backup during processing. The ransom note readme_locker.txt is dropped to the desktop only when the '-note' CLI flag is supplied; it directs victims to a TOX contact and a Tor-hosted data leak site that publishes victim names with countdown timers and progressive data disclosure. Pre-encryption, the malware performs anti-recovery actions: shadow copy deletion, Windows event log clearing, and recycle bin emptying.

## MITRE ATT&CK

- T1566 Phishing
- T1566.003 Spearphishing via Service
- T1219 Remote Access Tools
- T1106 Native API
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1027.007 Dynamic API Resolution
- T1685.005 Clear Windows Event Logs
- T1070.004 Indicator Removal: File Deletion
- T1036 Masquerading
- T1057 Process Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [Payouts King Takes Aim at the Ransomware Throne — Zscaler ThreatLabz](https://www.zscaler.com/blogs/security-research/payouts-king-takes-aim-ransomware-throne)
- [Payouts King Ransomware Evades EDR With Obfuscation and Direct System Calls — Cyber Security News](https://cybersecuritynews.com/payouts-king-ransomware-evades-edr/)
- [Payouts King Emerges: New Ransomware Operation Tied to Ex-BlackBasta Members — GBHackers](https://gbhackers.com/payouts-king-emerges/)
- [Payouts King Ransomware Bypasses EDR via Obfuscation and Direct Syscalls — GBHackers](https://gbhackers.com/payouts-king-ransomware-bypasses-edr/)
- [Threat Actor Deep Dive: Payouts King — Surefire Cyber](https://www.surefirecyber.com/threat-actor-deep-dive-payouts-king/)
- [Payouts King Takes Aim at the Ransomware Throne — Security Boulevard](https://securityboulevard.com/2026/04/payouts-king-takes-aim-at-the-ransomware-throne/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0692