Extracted

• • Target

    7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a

  • Size

    543KB

  • MD5

    998022b70d83c6de68e5bdf94e0f8d71

  • SHA1

    b87a947f3e85701fcdadd733e9b055a65a3b1308

  • SHA256

    7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a

  • SHA512

    2744b77f951bd2bb34b094dd3b54fcf8f7dca76e03c745809edc045749c814c7d88c9ddd69ad684a1c156716afae76b5ebec3f932d0f2a72b242878134f65647

  • SSDEEP

    12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlA:AzmoQqUiXw2s6yiVx

  Score

  10^/10

  blackbastadefense_evasiondiscoveryexecutionimpactransomwarespywarestealercredential_access

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta

  • Blackbasta family

    blackbasta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (9234) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2