Extracted

• • Target

    9f948af3a30f125dcd24d8a628b3a18c66b3d72baede8496ee735cbdfd9cf0c7

  • Size

    1.2MB

  • MD5

    42c15072a8aa222a10d96311969aa77a

  • SHA1

    a87e4a21996a4a35e0b96a19bcd0b6964d459378

  • SHA256

    9f948af3a30f125dcd24d8a628b3a18c66b3d72baede8496ee735cbdfd9cf0c7

  • SHA512

    d48489ac42670749e98a77469a35320621f0597fd2da70fd4407e86d283c62c7ccf8ce67b5a4e20208bd5fd8f826d082e5f6286719eb5a8b098a762abba77184

  • SSDEEP

    24576:9KuyRQZ7taLNQyucw8VQ3QhCtGEiCefenQ83pZkBTz8GE652kt:d2eQob7Q+ZITzqIV

  Score

  10^/10

  blackbastaransomware

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta

  • Black Basta payload

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (7154) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops startup file

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1