Dynamically Analyzing Linux Black Basta Ransomware

In this video, we dynamically analyze the Linux Black Basta ransomware family. We use strace to determine the required directories and trigger both the encryption and decryption behavior.

---

Timestamps:
00:00 Intro
00:44 Analysis Enviroment
02:13 Starting Dynamic Analysis
03:19 Decryptors
04:26 Trigging Encryptor
06:21 Strace
08:00 VMWare ESXi
09:39 VMFS Test
12:30 Ransom Note
15:07 Strace Encryptor Output
15:50 Multithreading
17:48 Triggering Decryptor
19:38 Dumped key?
20:58 Decryptor Round 2
22:58 Successful Decryption!
23:27 Recap

---

Software Links Mentioned in Video:
strace manpage:

---
Malware Examined in the video (BlackBasta):

Decryptor:
sha256:96339a7e87ffce6ced247feb9b4cb7c05b83ca315976a9522155bad726b8e5be

Encryptor:
sha256:0d6c3de5aebbbe85939d7588150edf7b7bdc712fceb6a83d79e65b6f79bfc2ef

---
laurieWIRED Twitter:

laurieWIRED Website:

laurieWIRED Github:

laurieWIRED HN:

laurieWIRED Reddit:

[lkron]

This must be one of the most underrated channels on YT.

[miguelmahecha]

I absolutely love this format. The "window" switching is really cool.

[rabbirt]

you're so fricken cool, love the editing every time. best youtuber

[angelalopez]

¡Gracias! Hermosa en verdad tu conocimiento me ayuda a ser más eficiente en mi trabajo como fintech developer engineer.

[samrichardson]

The fact that you can analyze, decypher, plan ahead and slow yourself down for us, in order to perform this perfectly clear pedagogic explanation, all at once, is kinda impressive.

[randommoosebrains]

Thanks for uploading. I’m learning a lot of cool stuff from the channel. Haven’t seen all the videos but thank the algorithm for the recommending this channel.

[tkondoff]

The analysis container is *exactly* what I've been looking for! Thank you! 🤘

[isaacpardo]

I'm kinda bing watching your videos today and from all the references I've seen, I'm so happy The Wired (wired-o lol) wasn't just something I was trying to imagine out of nowhere. ❤ SEL, and your content. I'm hooked!

[mytechnotalent]

Great job Laurie! I love how strace can show so much. In a CTF I wrote in x86 Assembler, I worked to hide all of the traces but few ever go to such lengths.

[QLPJosh]

This was a great watch, really interesting stuff. Thank you for creating this

[MaZderMind]

Kudos to the amount of work you put into the production! The MacOS/WinXP crossover made me lough and love to the Corgi :)
Also, you have a really calm and structured way of teaching. 👌

[kumarprateek]

Thanks for these videos. It has really got me interested in malware analysis.

[math]

Excellente vidéo, merci pour ce contenu

[szymoniak]

typical Linux experience: you even have to troubleshot malware and actually try hard to get it working

[IsaiahG-emin]

I love your videos! I learn so much!! Thank you

[ismiregalichkochdasjetztso]

I started my reverse engineering career as a teen in the late 80s, mostly cracking games and hunting malware on MS-DOS. Glad to see the next generation going strong at it!

[afkbender]

awesome and way above my head! ::Swoosh::

[mojed]

This women has great style :-) and so cool how she explains stuff. Thanks

[peterweston]

"Present Day, Present Time -- Copland OS"

[kikomartinez]

Ok you had ne at the Lain intro lol subscribed