Overview

overview

10

Static

static

10

v2c.bin.exe

windows7_x64

10

v2c.bin.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    v2c.bin

  • Size

    80KB

  • Sample

    210920-pymmvaggfp

  • MD5

    cdece7491402c7cb06964ffc680d791a

  • SHA1

    8c5427baa48d840bc7508eeaa7c091d368a68e0a

  • SHA256

    b0e929e35c47a60f65e4420389cad46190c26e8cfaabe922efd73747b682776a

  • SHA512

    5ff6eb1f81bb309aede35a9aef26ea587b6c2e49bea66f6e91bf1dbc02cc978869a1bfd376b524522cc8bf99f48ee7f62db9322212342bc4d7af40984290e501

Score
10/10
blackmatter879194e26a0ed7cf50f13c681e711c82ransomware

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

879194e26a0ed7cf50f13c681e711c82

Credentials

  • Protocol:     smtp
  • Port:
    587
  • Username:
    _vpn@xnet.oe.olympus
  • Password:
    vpnvpn08

  • Protocol:     smtp
  • Port:
    587
  • Username:
    adm_sprinx@xnet.oe.olympus
  • Password:
    Apr@123456

  • Protocol:     smtp
  • Port:
    587
  • Username:
    dom_ecopysupport@xnet.oe.olympus
  • Password:
    Olympus$12345

  • Protocol:     smtp
  • Port:
    587
  • Username:
    DOM_Jannick.Berghaeu@xnet.oe.olympus
  • Password:
    Olympus@12345

  • Protocol:     smtp
  • Port:
    587
  • Username:
    ofr-tina@xnet.oe.olympus
  • Password:
    ofrt!n@

  • Protocol:     smtp
  • Port:
    587
  • Username:
    svc_ciscoise@xnet.oe.olympus
  • Password:
    Is3@dmin

  • Protocol:     smtp
  • Port:
    587
  • Username:
    adm_ArunachaNa@xnet.oe.olympus
  • Password:
    Sinchan@12345

  • Protocol:     smtp
  • Port:
    587
  • Username:
    ascuser@xnet.oe.olympus
  • Password:
    HappyDays.12

  • Protocol:     smtp
  • Port:
    587
  • Username:
    dom_admanager@xnet.oe.olympus
  • Password:
    Qwerasdzx123!@#

  • Protocol:     smtp
  • Port:
    587
  • Username:
    dom_hasansy@xnet.oe.olympus
  • Password:
    Coro@12345

  • Protocol:     smtp
  • Port:
    587
  • Username:
    Dom_HMarme@xnet.oe.olympus
  • Password:
    Ultimate06!

  • Protocol:     smtp
  • Port:
    587
  • Username:
    dom_obuehring@xnet.oe.olympus
  • Password:
    Olympus@12345

  • Protocol:     smtp
  • Port:
    587
  • Username:
    Dom_SadasivaPa@xnet.oe.olympus
  • Password:
    Zxcasd@123

  • Protocol:     smtp
  • Port:
    587
  • Username:
    dom_Supportat@xnet.oe.olympus
  • Password:
    Qweasdzxc@12345

  • Protocol:     smtp
  • Port:
    587
  • Username:
    ofi-backup@xnet.oe.olympus
  • Password:
    Helmi-2005

  • Protocol:     smtp
  • Port:
    587
  • Username:
    SVC_AcrossEvent@xnet.oe.olympus
  • Password:
    Acr0$$@123

  • Protocol:     smtp
  • Port:
    587
  • Username:
    svc_vCenterILMT@xnet.oe.olympus
  • Password:
    V1rtu@1c3!
Attributes
  • attempt_auth

    true

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    false

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Extracted

Path

C:\1rWCqamCt.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What data stolen? From your network was stolen some amount of data automatically (reach us to get the amount). If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. Blog post link: %BLOG_URL% >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/9YDGH04DC6ZS7RP0085Q >> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/9YDGH04DC6ZS7RP0085Q

Targets

    • Target

      v2c.bin

    • Size

      80KB

    • MD5

      cdece7491402c7cb06964ffc680d791a

    • SHA1

      8c5427baa48d840bc7508eeaa7c091d368a68e0a

    • SHA256

      b0e929e35c47a60f65e4420389cad46190c26e8cfaabe922efd73747b682776a

    • SHA512

      5ff6eb1f81bb309aede35a9aef26ea587b6c2e49bea66f6e91bf1dbc02cc978869a1bfd376b524522cc8bf99f48ee7f62db9322212342bc4d7af40984290e501

    Score
    10/10
    blackmatterransomware

    • BlackMatter Ransomware

      BlackMatter ransomware group claims to be Darkside and REvil succesor.

      ransomwareblackmatter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks