Extracted

• • Target

    d9d2838327c081a6daf9528c77ff3a8ac88e8ff73521b97d34af0d3da5807e7c

  • Size

    743KB

  • MD5

    b3c9bb42bca62dea8ba72b8c04200ead

  • SHA1

    4a535112c45ea02782a154d271556a324110db52

  • SHA256

    d9d2838327c081a6daf9528c77ff3a8ac88e8ff73521b97d34af0d3da5807e7c

  • SHA512

    721d0f67c552b79ceb8fdef092e75de1308e062c6b783d220f992e5b9c001e07c40b8a416adee5da20292157057e81cfa3eb618d33f0ebd1e89b9d5355fd0a7b

  • SSDEEP

    12288:B9uxWTNaFP2vTXhyy9cetos+cjMHeUT3VBoKfzY5gVNI3Ng+t:B9uxWTo52Thn9ce5675BoIz0gV6dvt

  Score

  10^/10

  blackbastadefense_evasionexecutionimpactransomware

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (1345) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Loads dropped DLL

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2