TF-MAL-ps1.blacksun
📛 Threat Title
Malware family: BlackSun
Description
ThreatFox malware family `ps1.blacksun`. Printable name: BlackSun.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
ps1.blacksun
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/ps1.blacksun
IOC database
- Type
- domain
- Value
ps1.blacksun- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-ps1.blacksun
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/ps1.blacksun
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:any.run
Online sandbox report for BlackSun .exe, verdict: Malicious activity
-
web:blog.qualys.com
Written by Mukesh Choudhary, Principal SME, Remediation and FIM Write to Mukesh at mchoudhary@qualys.com LPE vulnerability Windows, Microsoft Defender zero-day, mitigate without patch, RedSun vulnerability, TruRisk Eliminate, vulnerability mitigation , vulnerability remediation Show Comments (2)
-
web:blogs.vmware.com
The execution of BlackSun , shown in Figure 1, shows very limited subprocesses. It will use additional execution of PowerShell for running internal capabilities, as well as the use of net.exe to map network drives.
-
web:github.com
Reference Links 1 BlackSun Ransomware - Decryption, removal, and lost files recovery (updated) (pcrisk.com) 2 BlackSun Ransomware - The Dark Side of PowerShell - VMware Security Blog - VMware 3 Remove BlackSun Ransomware virus - Real Malware Guide 4 BlackSun Virus (. blacksun Files of Ransomware) — How to remove virus? (howtofix.guide) 5 ...
-
web:malpedia.caad.fkie.fraunhofer.de
Ransomware. 2022-01-27 ⋅ vmware ⋅ VMWare BlackSun Ransomware - The Dark Side of PowerShell BlackSun
-
web:ntapinsight.com
BlackSun deletes Windows System Restore Points via WMIC before encryption starts - in approx. 7 seconds. Spawns a custom Rust-based double-extortion module (name "yaRUS") that compresses and exfiltrates <200 MB before encryption.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.csoonline.com
New PoC shows how Microsoft Defender can be tricked into rewriting malicious files into protected locations, enabling SYSTEM-level privilege escalation on fully patched Windows systems.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.pcrisk.com
Screenshot of files encrypted by BlackSun (". BlackSun " extension): BlackSun ransomware removal: Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware .
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.