Merge pull request #407 from kevross33/patch-37

Add Black Basta ransomware extension
CAPESandbox · Mar 20, 2024 · d010d2c · d010d2c
2 parents e659979 + 45c6c50
commit d010d2c
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/modules/signatures/windows/ransomware_fileextensions.py b/modules/signatures/windows/ransomware_fileextensions.py
@@ -133,6 +133,7 @@ def run(self):
             (".*\.__NIST_[A-Z0-9]{4}__$", ["Babuk"]),
             (".*\.phoenix$", ["PhoenixCryptoLocker"]),
             (".*\.blackbyte$", ["BlackByte"]),
+            (".*\.basta$", ["BlackBasta"]),
         ]
 
         for indicator in indicators: