blackmatter | c728e3a0d4a293e44314d663945354427848c220d05d5d87cdedd9995fee3dfe

General

Target

c728e3a0d4a293e44314d663945354427848c220d05d5d87cdedd9995fee3dfe
Size

67KB
Sample

211005-pr879shgb7
MD5

639bb7abbd9bc6a9c275d0bf9555b610
SHA1

e4831da0e8fe5f0a01cd42693e607bc611423c16
SHA256

c728e3a0d4a293e44314d663945354427848c220d05d5d87cdedd9995fee3dfe
SHA512

f01621fab7ba598b80d52675c20d0d4bb4749b91df3298ee1bd6d6d410eb54d091677f85a2d4673eb9dc3d8cff6f4a328735226de0f5a01bd314dbe6d9af92aa

Score

10^/10

Malware Config

Extracted

Family

blackmatter

Version

1.2

Botnet

bab21ee475b52c0c9eb47d23ec9ba1d1

C2

https://paymenthacks.com

http://paymenthacks.com

https://mojobiden.com

http://mojobiden.com

Attributes

attempt_auth
false
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Path

C:\AVx2lZV2X.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R. >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R

Targets

- Target
  
  c728e3a0d4a293e44314d663945354427848c220d05d5d87cdedd9995fee3dfe
- Size
  
  67KB
- MD5
  
  639bb7abbd9bc6a9c275d0bf9555b610
- SHA1
  
  e4831da0e8fe5f0a01cd42693e607bc611423c16
- SHA256
  
  c728e3a0d4a293e44314d663945354427848c220d05d5d87cdedd9995fee3dfe
- SHA512
  
  f01621fab7ba598b80d52675c20d0d4bb4749b91df3298ee1bd6d6d410eb54d091677f85a2d4673eb9dc3d8cff6f4a328735226de0f5a01bd314dbe6d9af92aa
Score

10^/10

blackmatter ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Blocklisted process makes network request
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

BlackMatter Ransomware

Blocklisted process makes network request

Modifies extensions of user files

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2