Extracted

• • Target
    sub_9a55f5588628.bin
  • Size 542KB
  • SHA256 9a55f55886285eef7ffabdd55c0232d1458175b1d868c03d3e304ce7d98980bc
  • MD5 c115bbbdb1a61f8c553d74802bfd78fb
  • SHA1 1f439569e3c1c14ea9f02235f8f45c49e2764160
  • SHA512 6ad701415ce5e1f94144a979f7e347499ecd80e4de4705dbe9570ad53a90b58034ea98f2ec9d257a330ec47ffeacdbd420f581ad8a4d76b0c7ad4bb198b1ab84
  • SSDEEP 12288:trkm8R9qXgmj3d7khtgfpedbKbiTuDZWhswtik5j2w+f:2Ujt7+twpedbKb1dWhse9K
  • TLSH
    T13DC47D217491C07AD67243F14DACDB9135BEEC300F621ACBE3C45A6D177C9E16A329BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionblackbastaimpactransomwarecredential_accessstealer

  • Family: Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (1602) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2