Overview

overview

10

Static

static

1

rufus.exe

windows7-x64

10

rufus.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rufus.exe

  • Size

    1.2MB

  • Sample

    230807-zhk47ahd28

  • MD5

    9b46fd720844076511d94496aac2b47f

  • SHA1

    5be995e55f304e753116c5d38bac665a51539ebd

  • SHA256

    9635c91adf7f8ee699b4b1b63d7342f3c732dfea9896cc0a67d9789b08577b5f

  • SHA512

    2eb03c14a9824fc941073433921a984f34d82025544fc933bcdbc0ba4eb031e827eea178297cd3af9ad56cd806acbea5d69b9faa033a56c16b8e01d608b18730

  • SSDEEP

    24576:oU1QcXKGCqN80AkGDU77N973AiZza4Wm7ZgqvenydUCAxik:oUNxH7N9zAV6YxP

Score
10/10
blackbastaevasionransomware

Malware Config

Targets

    • Target

      rufus.exe

    • Size

      1.2MB

    • MD5

      9b46fd720844076511d94496aac2b47f

    • SHA1

      5be995e55f304e753116c5d38bac665a51539ebd

    • SHA256

      9635c91adf7f8ee699b4b1b63d7342f3c732dfea9896cc0a67d9789b08577b5f

    • SHA512

      2eb03c14a9824fc941073433921a984f34d82025544fc933bcdbc0ba4eb031e827eea178297cd3af9ad56cd806acbea5d69b9faa033a56c16b8e01d608b18730

    • SSDEEP

      24576:oU1QcXKGCqN80AkGDU77N973AiZza4Wm7ZgqvenydUCAxik:oUNxH7N9zAV6YxP

    Score
    10/10
    blackbastaransomwareevasion

    • Black Basta

      A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

      ransomwareblackbasta

    • Black Basta payload

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks