Extracted

• • Target
    2026-03-11_d94fecc7d018f067d276c8907f73db67_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat
  • Size 542KB
  • SHA256 c85a22e86c0e7b60e53317f6307f9a0411b23f73f2e1cc9ef11eb4019c0a251e
  • MD5 d94fecc7d018f067d276c8907f73db67
  • SHA1 a50b25b27ada0821b8bff954c782b5e731b0e510
  • SHA512 c794c536275d3207cd5322034f6bf3edea5702a3d781f42d79792331c3790f39ed1d087ec51399cd62c84e534adac7b8b65cc50ff546c0e5365df2f18257b29d
  • SSDEEP 12288:Krkm8R9qXgmj3d7khtgfpedbKbiTuDZWhswtikQjzZ+f:lUjt7+twpedbKb1dWhseM3
  • TLSH
    T169C47D217491C07AD67243F14DACDB9135BEEC300F621ACBE3C4596D177C9E1AA329BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionblackbastaimpactransomwarecredential_accessstealer

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta

  • Blackbasta family

    blackbasta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (278) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2