blackmatter | 66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f

General

Target

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f
Size

78KB
Sample

210823-2zpa73sjs2
MD5

feed59d9048fdc17962b71f7550388dd
SHA1

b24887db18de6b017687c2aca95cf1ccfa0d8ea3
SHA256

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f
SHA512

4fcd03ec2e73e0ce75774c21db66184bc3eab9128cac1cae9d1487a6bb8461a5641a7c3be590291f561833c22377e2f74c09084b37fda1f4d524b2607b252284

Score

10^/10

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

64139b5d8a3f06921a9364c262989e1f

C2

https://mojobiden.com

http://mojobiden.com

Attributes

attempt_auth
false
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Path

C:\1rWCqamCt.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/9BEBTCZQN6BQJ94DJXJ >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/9BEBTCZQN6BQJ94DJXJ

Targets

- Target
  
  66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f
- Size
  
  78KB
- MD5
  
  feed59d9048fdc17962b71f7550388dd
- SHA1
  
  b24887db18de6b017687c2aca95cf1ccfa0d8ea3
- SHA256
  
  66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f
- SHA512
  
  4fcd03ec2e73e0ce75774c21db66184bc3eab9128cac1cae9d1487a6bb8461a5641a7c3be590291f561833c22377e2f74c09084b37fda1f4d524b2607b252284
Score

10^/10

blackmatter ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2