BlackBasta — Örnek SHA256: c4c8be0c | Critical Tehdit Analizi

BlackBasta | Threat Level: critical | Type: Ransomware

Cryptographic Identifiers

SHA256	`c4c8be0c939e4c24e11bad90549e3951b7969e78056d819425ca53e87af8d8ed`
MD5	`b113be47b5b601e0a58d774b4ce70a17`
File Type	exe
Size	667.9 KB
First Seen	2022-12-02
File Name	c4c8be0c939e4c24e11bad90549e3951b7969e78056d819425ca53e87af8d8ed
Tags	BlackBasta, exe, Ransomware

Malware Family: BlackBasta

Black Basta, Conti üyeleriyle ilişkilidir.

Type	Ransomware
Programming Language	C++
Target Platform	Windows/Linux
C2 Protocol	—
Purpose	Conti türevi ransomware
First Seen Year	2022

Threat Indicators (IOC)

SHA256: c4c8be0c939e4c24e11bad90549e3951b7969e78056d819425ca53e87af8d8ed
MD5: b113be47b5b601e0a58d774b4ce70a17

You can verify all hash values of this sample on VirusTotal.

System Cleanup Guide

Sistemi ağdan DERHAL ayırın — diğer cihazlara yayılmayı durdurun
Do not pay the ransom — there is no guarantee your files will be restored
Quarantine the affected drives
Kullanılan fidye yazılımı ailesini belirleyin (nomoreransom.org)
Try available decryptor tools (the NoMoreRansom project)
Report the incident to the authorities (cybercrime unit)
Temiz bir yedekten kurtarın; yedeğiniz yoksa sürücüyü saklayın

YARA Rule Hints

rule BlackBasta_SHA256 {
    meta:
        description = "BlackBasta sample: c4c8be0c939e4c24"
        threat_level = "critical"
        first_seen = "2022-12-02"
    condition:
        hash.sha256(0, filesize) == "c4c8be0c939e4c24e11bad90549e3951b7969e78056d819425ca53e87af8d8ed"
}

BlackBasta — Malware Profile

Black Basta ransomware grubu loaer/dropper. Microsoft Office Setup Engine (ose.pdb) olarak gizlenir. Global\OfficeSourceEngine64Mutex sahte mutex. Self-modifying .ex_cod section. Minimal import + runtime GetProcAddress API cozme. WinHttp C2. Token manipulasyonu.

Malware Type

Ransomware

Programming Language

C++

C2 Protocol

—

Target Systems

Windows/Linux

Capabilities & Behavior

Dosya Şifreleme (AES/RSA)

Gölge Kopya Silme

Yedek Kaldırma

Fidye Notu Oluşturma

Kalıcılık Sağlama

Ağ Paylaşımı Şifreleme

Anti-Analiz Teknikleri

Çift Gasp (Data Leak)

IOC List (2 indicators)

IOC — BlackBasta

# SHA256
c4c8be0c939e4c24e11bad90549e3951b7969e78056d819425ca53e87af8d8ed 

# MD5
b113be47b5b601e0a58d774b4ce70a17

Type	Value	Note
sha256	c4c8be0c939e4c24e11bad90549e3951b7969e78056d819425ca53e87af8d8ed	Sample:BlackBasta
md5	b113be47b5b601e0a58d774b4ce70a17	Sample:BlackBasta

BlackBasta — Go to Full Profile →

C2 Servers (1 recorded servers for this family)

Address	Type	Port	Protocol	Status	Country
aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion	domain	443	—	inactive	—

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.