{
  "family": "black",
  "sample_count": 329,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nThe identifier \"Black\" represents a generic heuristic classification used by various endpoint protection platforms (EPP). It is not a distinct, standalone malware family. Rather, it is a risk indicator often applied to files that reside on a known blacklist, contain generic malicious code snippets, or are fragmented components of larger, named families (such as BlackEnergy, Blackhole exploit kit, or BlackMatter ransomware).\n\n<h3>Behavioral Context and Detection</h3>\nWhen an antivirus engine flags a file with a generic \"Black\" label, it indicates that the file failed a reputation check or exhibited behaviors that are definitively malicious, but the engine cannot classify it further. This often happens with:\n<ul>\n<li><strong>Packed Executables:</strong> Files obfuscated with custom packers where the underlying payload cannot be immediately analyzed.</li>\n<li><strong>Dropper Artifacts:</strong> Small, intermediary scripts (PowerShell, VBScript) used merely to download a primary payload.</li>\n<li><strong>Blacklisted Hashes:</strong> Files whose SHA-256 hashes exactly match entries in global threat intelligence feeds, regardless of their specific family classification.</li>\n</ul>\n\n<h3>Risk Assessment and Triage</h3>\nDespite the lack of a specific family name, a \"Black\" detection must be treated as a confirmed, high-severity malicious event. The generic nature of the label means the threat could range from a simple adware installer to a sophisticated ransomware encryptor.\n\n<h3>Incident Response Actions</h3>\n<ul>\n<li><strong>Threat Intelligence Correlation:</strong> Extract the file hash (MD5, SHA-256) of the flagged executable and query it against external threat intelligence platforms (e.g., VirusTotal, Hybrid Analysis) to determine its true identity and capabilities.</li>\n<li><strong>Endpoint Isolation:</strong> Quarantining the file is insufficient; the entire endpoint should be isolated from the network to prevent potential lateral movement while the analysis is conducted.</li>\n<li><strong>Root Cause Analysis:</strong> Investigate the origin of the file. Determine how it arrived on the system (e.g., email attachment, web download, USB drive) to patch the initial vector of compromise.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Blacklist.Generic",
    "Generic.Black",
    "Trojan.Generic.Black"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:03:45Z",
  "type": "Generic",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}