blackmatter | ccee26ea662c87a6c3171b091044282849cc8d46d4b9b9da6cf429b8114c4239

General

Target

ccee26ea662c87a6c3171b091044282849cc8d46d4b9b9da6cf429b8114c4239
Size

80KB
Sample

211103-q91vaadhg7
MD5

e88479a6a059eb522d2fec40fe2e1a88
SHA1

4bea73917d60c7b09c3f74ca2b1c80f27492b15f
SHA256

ccee26ea662c87a6c3171b091044282849cc8d46d4b9b9da6cf429b8114c4239
SHA512

40e9533188e2b76e27e095c8141851fa7dcddf85ddd686494ada2a48978ea429e6f507a0504a545c79df7dfcdd516ce162e5893704018a4a23c4fd5ae7ad9bc8

Score

10^/10

blackmatter ransomware

Malware Config

Extracted

Path

C:\6amPnJyPq.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/YX6RXMC65MRX8LLQ >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/YX6RXMC65MRX8LLQ

Targets

- Target
  
  ccee26ea662c87a6c3171b091044282849cc8d46d4b9b9da6cf429b8114c4239
- Size
  
  80KB
- MD5
  
  e88479a6a059eb522d2fec40fe2e1a88
- SHA1
  
  4bea73917d60c7b09c3f74ca2b1c80f27492b15f
- SHA256
  
  ccee26ea662c87a6c3171b091044282849cc8d46d4b9b9da6cf429b8114c4239
- SHA512
  
  40e9533188e2b76e27e095c8141851fa7dcddf85ddd686494ada2a48978ea429e6f507a0504a545c79df7dfcdd516ce162e5893704018a4a23c4fd5ae7ad9bc8
Score

10^/10

blackmatter ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2