blackbasta | 9f93e98182b2e6711d99f1a24c64a46afcb2152e889797a9dfc16f5150084228

Analysis

max time kernel
0s
max time network
131s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
31-07-2024 12:07

Target

7e54531d85a15d61b59e40e1c1a2e94c31abc299751067e005de4b13402c29c7
Size

84KB
MD5

c4f3213878f47d15f0d1c5b49767502c
SHA1

9327e9fd5049b8c1b404f230b732bc4ee63eced6
SHA256

7e54531d85a15d61b59e40e1c1a2e94c31abc299751067e005de4b13402c29c7
SHA512

2efe5b26495caa57ddf47b5cf5a3cd9e57723b408a552518ce06021a53aa00c069eb05abcc87590ba6e2eebaf7cae5a17a81340a4d3f45760e21723e7b3bd9e2
SSDEEP

1536:31Gjxa4ZK8rgsZD4JGwcCujP87Dyyc0DPSPFkLVpFm6GFdi1vszVjem:lGNaKNTJ4JnhDyyVSPFQ/FmpHuvszEm

Score

10^/10

Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta

Black Basta payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2826-1-0x0000000000400000-0x000000000062afa0-memory.dmp	family_blackbasta

Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.

Processes:

7e54531d85a15d61b59e40e1c1a2e94c31abc299751067e005de4b13402c29c7

description ioc process

File opened for reading /proc/self/exe 7e54531d85a15d61b59e40e1c1a2e94c31abc299751067e005de4b13402c29c7

description	ioc	process
File opened for reading	/proc/self/exe	7e54531d85a15d61b59e40e1c1a2e94c31abc299751067e005de4b13402c29c7

/tmp/7e54531d85a15d61b59e40e1c1a2e94c31abc299751067e005de4b13402c29c7
/tmp/7e54531d85a15d61b59e40e1c1a2e94c31abc299751067e005de4b13402c29c7
1⤵
- Reads runtime system information
PID:2826