blackmatter | 6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b

General

Target

6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b
Size

887KB
Sample

211123-m9ltksdab2
MD5

66d8f3d21088cea87dd99f37efb92795
SHA1

ba7cad1cbb5204ac8d2ddb3d399738657f08e209
SHA256

6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b
SHA512

df0cd4d9a9c3337aed6a62bce14ddb3c6001e215ab956f7f0e98d9a9c7ae69ec24fc2aff48cc5899312f8473f397f9d9bcf554b5b9ef626a8c95f257f5f23554

Score

10^/10

blackmatter ransomware

Malware Config

Extracted

Path

C:\gawreXkrr.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R. >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R

Targets

- Target
  
  6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b
- Size
  
  887KB
- MD5
  
  66d8f3d21088cea87dd99f37efb92795
- SHA1
  
  ba7cad1cbb5204ac8d2ddb3d399738657f08e209
- SHA256
  
  6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b
- SHA512
  
  df0cd4d9a9c3337aed6a62bce14ddb3c6001e215ab956f7f0e98d9a9c7ae69ec24fc2aff48cc5899312f8473f397f9d9bcf554b5b9ef626a8c95f257f5f23554
Score

10^/10

blackmatter ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Blocklisted process makes network request
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2