General

  • Target

    BluStealer_2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c

  • Size

    79KB

  • Sample

    211015-skexmabgfn

  • MD5

    f1c260c31b9d3f9ff54a142d508ec602

  • SHA1

    6b25c80e8b2dca94ea6b6a95745a496ec0bcabd3

  • SHA256

    2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c

  • SHA512

    9412a185d008ded02e2061cd4e998222071923f6260ecdcc9a3f1969ea2aa89a9493866e13450d82b8ab390ec78b24d7ba82a6e2618d11cf27d67f43a7d39d6a

Malware Config

Extracted

Family

blackmatter

Version

1.9

Botnet

28cc82fd466e0d0976a6359f264775a8

C2

https://mojobiden.com

http://mojobiden.com

Attributes
  • attempt_auth

    false

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Extracted

Path

C:\chkvc3MvG.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your security perimeter was BREACHED and all files on your critically important servers and hosts were completely ENCRYPTED. Also we has DOWNLOADED your most SENSITIVE Data We have collected the most important info such as: -Accounting files, Financial documents, Banking and Billing statements, HR documents, Payrolls, Credit Cards -We have your Backups, Legal Documents, Personal IDs, Investigations Reports, Audit Reports, Revenues reports -Confidential Agreements, NDA, Corporate Contracts, WorkFiles, Drawings, Clients and Employees contacts and other personal information -Also we have your Private Correspondence .msg files and a lot of other Sensitive info. https://prnt.sc/1o6e5a2 https://prnt.sc/1o6ei7g https://prnt.sc/1o6exr8 https://prnt.sc/1o6fbxu https://prnt.sc/1o6fvkn >>> What data stolen? From your network was stolen 80 GB of data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. Blog post link: %BLOG_URL% >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/EBVCVJNCPM6A3NKJ >> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

https://prnt.sc/1o6e5a2

https://prnt.sc/1o6ei7g

https://prnt.sc/1o6exr8

https://prnt.sc/1o6fbxu

https://prnt.sc/1o6fvkn

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/EBVCVJNCPM6A3NKJ

Targets

    • Target

      BluStealer_2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c

    • Size

      79KB

    • MD5

      f1c260c31b9d3f9ff54a142d508ec602

    • SHA1

      6b25c80e8b2dca94ea6b6a95745a496ec0bcabd3

    • SHA256

      2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c

    • SHA512

      9412a185d008ded02e2061cd4e998222071923f6260ecdcc9a3f1969ea2aa89a9493866e13450d82b8ab390ec78b24d7ba82a6e2618d11cf27d67f43a7d39d6a

    • BlackMatter Ransomware

      BlackMatter ransomware group claims to be Darkside and REvil succesor.

    • suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)

      suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks