blackmatter | ed47e6ecca056bba20f2b299b9df1022caf2f3e7af1f526c1fe3b8bf2d6e7404

General

Target

ed47e6ecca056bba20f2b299b9df1022caf2f3e7af1f526c1fe3b8bf2d6e7404
Size

80KB
Sample

211103-q94k6sbbar
MD5

caf751f08b0fbe9ec99469f073c3262e
SHA1

445f7b8ddb50250eb5ee051af0e8a32e62173c95
SHA256

ed47e6ecca056bba20f2b299b9df1022caf2f3e7af1f526c1fe3b8bf2d6e7404
SHA512

06ce425fb1f8cd36e2d0c36e585b369cc327957559df1ff8403aa0f1054acae3bf78f7aa20c04dd5a418bca48b8bf8e42f489ac6d3cbc8199c355794df2a61c8

Score

10^/10

blackmatter ransomware

Malware Config

Extracted

Path

C:\6amPnJyPq.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/HCWB50PNECHW5CRCQF >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/HCWB50PNECHW5CRCQF

Targets

- Target
  
  ed47e6ecca056bba20f2b299b9df1022caf2f3e7af1f526c1fe3b8bf2d6e7404
- Size
  
  80KB
- MD5
  
  caf751f08b0fbe9ec99469f073c3262e
- SHA1
  
  445f7b8ddb50250eb5ee051af0e8a32e62173c95
- SHA256
  
  ed47e6ecca056bba20f2b299b9df1022caf2f3e7af1f526c1fe3b8bf2d6e7404
- SHA512
  
  06ce425fb1f8cd36e2d0c36e585b369cc327957559df1ff8403aa0f1054acae3bf78f7aa20c04dd5a418bca48b8bf8e42f489ac6d3cbc8199c355794df2a61c8
Score

10^/10

blackmatter ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2