blackbasta | 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a[.]bin

General

Target
7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.bin
Size 543KB
Sample221009-neebpahaep
SHA256 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a
MD5 998022b70d83c6de68e5bdf94e0f8d71
SHA1 b87a947f3e85701fcdadd733e9b055a65a3b1308
SHA512 2744b77f951bd2bb34b094dd3b54fcf8f7dca76e03c745809edc045749c814c7d88c9ddd69ad684a1c156716afae76b5ebec3f932d0f2a72b242878134f65647
SSDEEP 12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlA:AzmoQqUiXw2s6yiVx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackbasta

Malware Config

Signatures

Black Basta payload 1 IoCs

resource	yara_rule
sample	family_blackbasta

Blackbasta family
blackbasta

File Explorer

7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.bin

.exe 543KB

7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.bin

IMPHASH b3794746554a5701b2de3e5ea435c59b
SHA256 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a
MD5 998022b70d83c6de68e5bdf94e0f8d71
SHA1 b87a947f3e85701fcdadd733e9b055a65a3b1308
SHA512 2744b77f951bd2bb34b094dd3b54fcf8f7dca76e03c745809edc045749c814c7d88c9ddd69ad684a1c156716afae76b5ebec3f932d0f2a72b242878134f65647
SSDEEP 12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlA:AzmoQqUiXw2s6yiVx
MD5 SHA1 SHA512 SSDEEP

windows x86

Black Basta payload

Minor OS version

Major OS version

Entry point

218987

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesExW GetFullPathNameW GetVolumeInformationW GetTempPathW GetVolumePathNamesForVolumeNameW CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap DeviceIoControl Sleep GetCurrentProcessId TerminateProcess GetFileAttributesW GetTickCount GetModuleFileNameW LocalFree FormatMessageW MoveFileW FreeConsole WriteConsoleW HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW FindVolumeClose FindNextVolumeW FindNextFileW FindFirstVolumeW FindFirstFileW FindClose CreateFileW GetCurrentDirectoryW FormatMessageA WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar GetStringTypeW QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess InitializeSListHead RaiseException RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW SetEndOfFile

user32

SystemParametersInfoW

shell32

SHChangeNotify

advapi32

RegSetValueExW RegCreateKeyExW

Resubmissions

Sharing