General
-
Target
f7b3da61cb6a37569270554776dbbd1406d7203718c0419c922aa393c07e9884.bin.sample
-
Size
78KB
-
Sample
210921-qksglshfb7
-
MD5
ead753c057b5c3888ed2484013400b82
-
SHA1
e7de753b9f1e4e771f51f9dc044628288ea831bd
-
SHA256
f7b3da61cb6a37569270554776dbbd1406d7203718c0419c922aa393c07e9884
-
SHA512
fd6e2a1ddc79d313b12f84f1df91d45b3972b825e153dfc62fd02d4fb9af72c4a0d1d05fcd141ab21232c7e72c0571562533c418bff7233206c89309f623b564
Static task
static1
Behavioral task
behavioral1
Sample
f7b3da61cb6a37569270554776dbbd1406d7203718c0419c922aa393c07e9884.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
f7b3da61cb6a37569270554776dbbd1406d7203718c0419c922aa393c07e9884.bin.sample.exe
Resource
win10-en-20210920
Malware Config
Extracted
blackmatter
2.0
5ecf7b9cde33f85a3eec9350275b5c4f
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
C:\1rWCqamCt.README.txt
blackmatter
http://blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion/xscSyb9oue/b2ec5065190ebe423b201a9f2af97bb7
http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/OR7OTLBK8D5UVHZ0Q
Targets
-
-
Target
f7b3da61cb6a37569270554776dbbd1406d7203718c0419c922aa393c07e9884.bin.sample
-
Size
78KB
-
MD5
ead753c057b5c3888ed2484013400b82
-
SHA1
e7de753b9f1e4e771f51f9dc044628288ea831bd
-
SHA256
f7b3da61cb6a37569270554776dbbd1406d7203718c0419c922aa393c07e9884
-
SHA512
fd6e2a1ddc79d313b12f84f1df91d45b3972b825e153dfc62fd02d4fb9af72c4a0d1d05fcd141ab21232c7e72c0571562533c418bff7233206c89309f623b564
Score10/10-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-