From 45c6c5052aa4c759048b6b5718a805c6411c27d3 Mon Sep 17 00:00:00 2001 From: kevross33 Date: Wed, 20 Mar 2024 00:41:11 +0000 Subject: [PATCH] Add Black Basta ransomware extension --- modules/signatures/windows/ransomware_fileextensions.py | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/signatures/windows/ransomware_fileextensions.py b/modules/signatures/windows/ransomware_fileextensions.py index 71b2674a..7698b056 100644 --- a/modules/signatures/windows/ransomware_fileextensions.py +++ b/modules/signatures/windows/ransomware_fileextensions.py @@ -133,6 +133,7 @@ def run(self): (".*\.__NIST_[A-Z0-9]{4}__$", ["Babuk"]), (".*\.phoenix$", ["PhoenixCryptoLocker"]), (".*\.blackbyte$", ["BlackByte"]), + (".*\.basta$", ["BlackBasta"]), ] for indicator in indicators: