blackbasta | 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa | Triage

Submit
Reports

Overview

overview

Static

static

5d2204f3a2...aa.exe

windows7-x64

5d2204f3a2...aa.exe

windows10-2004-x64

Sharing

General

Target

5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa
Size

563KB
Sample

230207-xahb8agd7s
MD5

3f400f30415941348af21d515a2fc6a3
SHA1

bd0bf9c987288ca434221d7d81c54a47e913600a
SHA256

5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa
SHA512

0d4c3ee8807bbbf635ce2d1ce1b747c23cc2724ff999580169e5514c7c97109083bea169bd6a5f8be35f3b679bb8446839fcc7a38f78503658eda306bec69154
SSDEEP

12288:TFx0B/O7JxPzW9JPlHKtxYRkG7zLfpXE6SbJ:Rx7zW9JPlGskG1v

Score

10^/10

blackbasta evasion ransomware

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe

Resource

win7-20220812-en

blackbasta evasion ransomware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa.exe

Resource

win10v2004-20220812-en

blackbasta evasion ransomware

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa
- Size
  
  563KB
- MD5
  
  3f400f30415941348af21d515a2fc6a3
- SHA1
  
  bd0bf9c987288ca434221d7d81c54a47e913600a
- SHA256
  
  5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa
- SHA512
  
  0d4c3ee8807bbbf635ce2d1ce1b747c23cc2724ff999580169e5514c7c97109083bea169bd6a5f8be35f3b679bb8446839fcc7a38f78503658eda306bec69154
- SSDEEP
  
  12288:TFx0B/O7JxPzW9JPlHKtxYRkG7zLfpXE6SbJ:Rx7zW9JPlGskG1v
Score

10^/10

blackbasta evasion ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

blackbastaevasionransomware

behavioral2

blackbastaevasionransomware

© 2018-2024

Terms | Privacy