blackbasta | sub_5d2204f3a20e[.]bin

General

Target
sub_5d2204f3a20e.bin
Size 563KB
Sample260524-b3eadad14n
SHA256 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa
MD5 3f400f30415941348af21d515a2fc6a3
SHA1 bd0bf9c987288ca434221d7d81c54a47e913600a
SHA512 0d4c3ee8807bbbf635ce2d1ce1b747c23cc2724ff999580169e5514c7c97109083bea169bd6a5f8be35f3b679bb8446839fcc7a38f78503658eda306bec69154
SSDEEP 12288:TFx0B/O7JxPzW9JPlHKtxYRkG7zLfpXE6SbJ:Rx7zW9JPlGskG1v
TLSH
T182C48D223491C43AE6B203F04DA8DB96617DFC310F6255CBE3C45A6D1A7C5F26B319BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware blackbasta

Malware Config

Signatures

Family: Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta

Black Basta payload 1 IoCs

resource	yara_rule
sample	family_blackbasta

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sub_5d2204f3a20e.bin

File Explorer

sub_5d2204f3a20e.bin

.exe 563KB

sub_5d2204f3a20e.bin

IMPHASH ede5e0724f09124ab3994aacb2b361db
SHA256 5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa
MD5 3f400f30415941348af21d515a2fc6a3
SHA1 bd0bf9c987288ca434221d7d81c54a47e913600a
SHA512 0d4c3ee8807bbbf635ce2d1ce1b747c23cc2724ff999580169e5514c7c97109083bea169bd6a5f8be35f3b679bb8446839fcc7a38f78503658eda306bec69154
SSDEEP 12288:TFx0B/O7JxPzW9JPlHKtxYRkG7zLfpXE6SbJ:Rx7zW9JPlGskG1v
TLSH
T182C48D223491C43AE6B203F04DA8DB96617DFC310F6255CBE3C45A6D1A7C5F26B319BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Black Basta payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

233083

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesExW GetFullPathNameW GetVolumeInformationW GetTempPathW GetVolumePathNamesForVolumeNameW OutputDebugStringW CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap DeviceIoControl SetEvent WaitForSingleObject CreateEventW Sleep GetFileAttributesW CreateThread GetModuleFileNameW LocalAlloc LocalFree FormatMessageW MoveFileW FreeConsole SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType CreateProcessW FindVolumeClose FindNextVolumeW FindNextFileW FindFirstVolumeW FindFirstFileW FindClose CreateFileW GetCurrentDirectoryW ReadConsoleW HeapReAlloc GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize WriteConsoleW GetCurrentProcessId FormatMessageA WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar GetStringTypeW QueryPerformanceCounter SetEndOfFile GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount ResetEvent IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess InitializeSListHead RaiseException RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW SetFileAttributesW ExitThread FreeLibraryAndExitThread GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetExitCodeProcess

user32

GetSystemMetrics SystemParametersInfoW

shell32

ShellExecuteA SHChangeNotify

advapi32

SetEntriesInAclW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx OpenServiceW OpenSCManagerW GetServiceDisplayNameW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigA RegSetValueExW RegOpenKeyExW RegCreateKeyExW SetSecurityDescriptorDacl SetFileSecurityW InitializeSecurityDescriptor AllocateAndInitializeSid

Sharing