blackmatter | b0e929e35c47a60f65e4420389cad46190c26e8cfaabe922efd73747b682776a

General

Target

v2c.bin
Size

80KB
Sample

210920-pymmvaggfp
MD5

cdece7491402c7cb06964ffc680d791a
SHA1

8c5427baa48d840bc7508eeaa7c091d368a68e0a
SHA256

b0e929e35c47a60f65e4420389cad46190c26e8cfaabe922efd73747b682776a
SHA512

5ff6eb1f81bb309aede35a9aef26ea587b6c2e49bea66f6e91bf1dbc02cc978869a1bfd376b524522cc8bf99f48ee7f62db9322212342bc4d7af40984290e501

Score

10^/10

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

879194e26a0ed7cf50f13c681e711c82

Credentials

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
vpnvpn08

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Apr@123456

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Olympus$12345

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Olympus@12345

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
ofrt!n@

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Is3@dmin

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Sinchan@12345

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
HappyDays.12

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Qwerasdzx123!@#

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Coro@12345

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Ultimate06!

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Olympus@12345

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Zxcasd@123

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Qweasdzxc@12345

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Helmi-2005

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
Acr0$$@123

Protocol: smtp
Port:
587
Username:
[email protected]
Password:
V1rtu@1c3!

Attributes

attempt_auth
true
create_mutex
true
encrypt_network_shares
true
exfiltrate
false
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Path

C:\1rWCqamCt.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What data stolen? From your network was stolen some amount of data automatically (reach us to get the amount). If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. Blog post link: %BLOG_URL% >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/9YDGH04DC6ZS7RP0085Q >> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/9YDGH04DC6ZS7RP0085Q

Targets

- Target
  
  v2c.bin
- Size
  
  80KB
- MD5
  
  cdece7491402c7cb06964ffc680d791a
- SHA1
  
  8c5427baa48d840bc7508eeaa7c091d368a68e0a
- SHA256
  
  b0e929e35c47a60f65e4420389cad46190c26e8cfaabe922efd73747b682776a
- SHA512
  
  5ff6eb1f81bb309aede35a9aef26ea587b6c2e49bea66f6e91bf1dbc02cc978869a1bfd376b524522cc8bf99f48ee7f62db9322212342bc4d7af40984290e501
Score

10^/10

blackmatter ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2