General
-
Target
e4a2260bcba8059207fdcc2d59841a8c4ddbe39b6b835feef671bceb95cd232d
-
Size
79KB
-
Sample
211005-mjgf6shfa8
-
MD5
5de71f0e1ad0e2c2968153809ffaff05
-
SHA1
f023f314327acd96cd8a0f8e32451b2d2dee61d0
-
SHA256
e4a2260bcba8059207fdcc2d59841a8c4ddbe39b6b835feef671bceb95cd232d
-
SHA512
2fce4fbdf3bc7e0dfa9cc90581c08ea6578522c65891e12359bd464b1ea007006979491b9049e4a20fabd196bf321275cc003d537236c2bd5bf8826f85543c05
Static task
static1
Behavioral task
behavioral1
Sample
e4a2260bcba8059207fdcc2d59841a8c4ddbe39b6b835feef671bceb95cd232d.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
e4a2260bcba8059207fdcc2d59841a8c4ddbe39b6b835feef671bceb95cd232d.exe
Resource
win10-en-20210920
Malware Config
Extracted
blackmatter
2.0
e4aaffc36f5d5b7d597455eb6d497df5
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
BBis#1ec
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
k8DbBSZYWWnr0QqrILoo
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
Smokie@CF
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
C:\1rWCqamCt.README.txt
blackmatter
http://blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion/YdWh7oMKjT/13f1a8efc53e2fa712813f4c39147a79
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/5AZHJFLKJNPOJ4F5O5T
Targets
-
-
Target
e4a2260bcba8059207fdcc2d59841a8c4ddbe39b6b835feef671bceb95cd232d
-
Size
79KB
-
MD5
5de71f0e1ad0e2c2968153809ffaff05
-
SHA1
f023f314327acd96cd8a0f8e32451b2d2dee61d0
-
SHA256
e4a2260bcba8059207fdcc2d59841a8c4ddbe39b6b835feef671bceb95cd232d
-
SHA512
2fce4fbdf3bc7e0dfa9cc90581c08ea6578522c65891e12359bd464b1ea007006979491b9049e4a20fabd196bf321275cc003d537236c2bd5bf8826f85543c05
Score10/10-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-