Extracted

• • Target

    file

  • Size

    545KB

  • MD5

    6a202e9a95f58938d02385e31d43ed87

  • SHA1

    53628c7a155ccb7af1135140083939018d3587f1

  • SHA256

    15abbff9fbce7f5782c1654775938dcd2ce0a8ebd683a008547f8a4e421888c4

  • SHA512

    c6684838b84499dc97c75f33c1d3be29c654b90d2f0293c33af6a986facc8a673275a0f33a82f43aa1a8e67684b07092e462b1e2c309450a9ec0486ec7b4a7d1

  • SSDEEP

    12288:tM9fIMGezCq1kWOgb/VPFAQxSNJ4krheZfIVWRkn8oXdd6:hbq1kWJb9PFAQxgJheZfY8gdI

  Score

  10^/10

  blackbastacredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta

  • Blackbasta family

    blackbasta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (9760) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2