Categories: Ransom

About “Ransom:Win32/BlackBasta.RPT!MTB” infection

The Ransom:Win32/BlackBasta.RPT!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/BlackBasta.RPT!MTB virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Authenticode signature is invalid
Attempts to modify desktop wallpaper
Writes a potential ransom message to disk
Exhibits possible ransomware file modification behavior
Harvests cookies for information gathering

How to determine Ransom:Win32/BlackBasta.RPT!MTB?


File Info:
name: F7B2ED72DF9D5DCAD069.mlwpath: /opt/CAPEv2/storage/binaries/5b6c3d277711d9f847be59b16fd08390fc07d3b27c7c6804e2170f456e9f1173crc32: 5F332F71md5: f7b2ed72df9d5dcad0697762f45ca1d6sha1: f8c5c36f0e5ad26ae987c1c9d097818944c9669esha256: 5b6c3d277711d9f847be59b16fd08390fc07d3b27c7c6804e2170f456e9f1173sha512: df5e702c51392a7bbb414a28a43651877ef04e8d8d9e35011c8aa3ebaea1185436a5f78b1bf2391b7741fa01385f33636c9acf6f469ef59a7534256e5039541essdeep: 12288:aEky5bwpy02iRaeXCP2CIcdoKAXMr+Mr+kJZ41:j02iRaeHPcdo18rTrf61type: PE32 executable (console) Intel 80386, for MS Windowstlsh: T141D49E3139C1C43BD67201B14D68EB66617EFC320F7149CBA7E81A6E5A7C6C25B32A17sha3_384: 8f50dc5a42373ef191a9cd700cbfb61cbaad9c1c2846b167e27a7aed904f1afa2aa0015d99719461a263409bcd92fb19ep_bytes: e834080000e974feffff8b4df464890dtimestamp: 2022-02-17 00:46:11
Version Info:
0: [No Data]

Ransom:Win32/BlackBasta.RPT!MTB also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.BlackBasta.j!c
Elastic	malicious (high confidence)
MicroWorld-eScan	DeepScan:Generic.Ransom.Basta.A.F68AFEB8
FireEye	Generic.mg.f7b2ed72df9d5dca
CAT-QuickHeal	Ransom.BlackBasta.S27972135
McAfee	RDN/Ransom
Cylance	Unsafe
Sangfor	Ransom.Win32.Generic.ky
K7AntiVirus	Trojan ( 00591eb31 )
BitDefender	DeepScan:Generic.Ransom.Basta.A.F68AFEB8
K7GW	Trojan ( 00591eb31 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/Trojan.CHDE-6627
ESET-NOD32	a variant of Win32/Filecoder.BlackBasta.C
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Ransomware.BlackBasta-9950285-0
Kaspersky	HEUR:Trojan-Ransom.Win32.Generic
Alibaba	Ransom:Win32/generic.ali2000027
Rising	Ransom.BlackBasta!8.156C4 (CLOUD)
Ad-Aware	DeepScan:Generic.Ransom.Basta.A.F68AFEB8
Emsisoft	DeepScan:Generic.Ransom.Basta.A.F68AFEB8 (B)
F-Secure	Trojan.TR/Kryptik.zjtzy
DrWeb	Trojan.MulDrop20.2919
Zillya	Trojan.GenKryptik.Win32.138394
TrendMicro	Ransom_BlackBasta.R06CC0DE122
McAfee-GW-Edition	BehavesLike.Win32.Generic.jh
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan-Ransom.BlackBasta
Jiangmin	Trojan.BlackBasta.a
Avira	TR/Kryptik.zjtzy
MAX	malware (ai score=83)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Ransom:Win32/BlackBasta.RPT!MTB
Arcabit	DeepScan:Generic.Ransom.Basta.A.F68AFEB8
ZoneAlarm	HEUR:Trojan-Ransom.Win32.Generic
GData	DeepScan:Generic.Ransom.Basta.A.F68AFEB8
Cynet	Malicious (score: 100)
AhnLab-V3	Ransomware/Win.BastaCrypt.C5106015
VBA32	BScope.Trojan.DelShad
ALYac	Trojan.Ransom.Filecoder
Malwarebytes	Malware.AI.3879235874
TrendMicro-HouseCall	Ransom_BlackBasta.R06CC0DE122
Tencent	Malware.Win32.Gencirc.11fac39e
Yandex	Trojan.Filecoder!Hr6FIeBHVdI
MaxSecure	Trojan.Malware.160109207.susgen
Fortinet	W32/Filecoder_BlackBasta.C!tr.ransom
BitDefenderTheta	Gen:NN.ZexaF.34742.NuX@a0u5M2ci
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen