What Will You Find in This Black Basta Ransomware Report?
Black Basta ransomware is a ransomware-as-a-service variant first identified in April 2022. Its operators use double extortion: they encrypt systems and steal data before demanding payment. CISA reports that, as of May 2024, Black Basta affiliates had impacted over 500 organizations globally. MITRE ATT&CK notes it targets Windows and VMware ESXi servers.
Learn Technical Method of Operation Details
You will find the technical details of the BlackBasta ransomware, its functions, and details about cyber attack tactics. The report will show many points about its technical details, detections, and IoCs.
Gain Knowledge About Future Attacks
By understanding its attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic. the BlackBasta ransomware employs sophisticated techniques to avoid analysis by security researchers. You need experts’ perspective.
What Does the Black Basta Technical Analysis Report Cover?
The report is a 19 page technical analysis dated 16.08.2024. It examines one Windows sample, a PE32 file named black.exe. Its chapters are Executive Summary, Scope, Technical Analysis, YARA Rule, MITRE ATT&CK Threat Matrix, Mitigation Strategies, Conclusion and Indicators of Compromise.
What Technical Findings Does It State?
- The report says the sample encrypts files with ChaCha20 and protects the key with a unique 4,096-bit RSA public key for each victim.
- It lists command line arguments: -encryptionpercent, -threads, -nomutex, -forcepath and -bomb. The report describes -bomb as used for lateral movement.
- It creates a mutex named “dsajdhas.0”.
- It runs vssadmin to delete all shadow copies, which removes backup snapshots.
- Before encryption it writes dlaksjdoiwq.jpg (wallpaper) and fkdjsadasd.ico (icon) to the %TEMP% directory and registers the icon under HKCR\.basta\DefaultIcon.
- Encrypted files get the “.basta” extension, and a readme.txt file is created after each file is encrypted.
Which MITRE ATT&CK Techniques Does It Map?
The matrix chapter covers Execution, Defense Evasion, Discovery and Impact. Impact includes T1486 Data Encrypted for Impact and T1490 Inhibit System Recovery.
How Does the Report Suggest Checking for This Sample?
- Look for the two files in the %TEMP% directory.
- Check for the HKCR\.basta\DefaultIcon registry key.
- Search the whole system for .basta files and readme.txt files.
- Examine process logs for suspicious command executions.
- Check whether the “dsajdhas.0” mutex exists.
The report also includes a YARA rule and a list of sample hashes in its indicators of compromise chapter.