Overview

overview

10

Static

static

10

730f2d6243...in.exe

windows7_x64

10

730f2d6243...in.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4.bin

  • Size

    80KB

  • Sample

    211224-wr2lraehf6

  • MD5

    5fe6daa399b18058f9b7e58fe31b4131

  • SHA1

    1ed39024b03b3490049b4d6f2577ca36e18b405a

  • SHA256

    730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4

  • SHA512

    31baf91130c7e932068e12fec6dfde7ad283487b9f01b92e64835cf91aba1c4f51602066994a8200b73d219e6ea82929cde1f11ca82fb2a48af90418e57e324c

Score
10/10
blackmatter3e8e2ab5fbb392508535983b7446ba17ransomware

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

3e8e2ab5fbb392508535983b7446ba17

C2

https://fluentzip.org

http://fluentzip.org
Attributes
  • attempt_auth

    false

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Extracted

Path

C:\y2VGe3tGZ.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. From your network was stolen more than 100 GB of data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/S2A4H6RGPHHLU1IJRLNTN >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/S2A4H6RGPHHLU1IJRLNTN

Targets

    • Target

      730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4.bin

    • Size

      80KB

    • MD5

      5fe6daa399b18058f9b7e58fe31b4131

    • SHA1

      1ed39024b03b3490049b4d6f2577ca36e18b405a

    • SHA256

      730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4

    • SHA512

      31baf91130c7e932068e12fec6dfde7ad283487b9f01b92e64835cf91aba1c4f51602066994a8200b73d219e6ea82929cde1f11ca82fb2a48af90418e57e324c

    Score
    10/10
    blackmatterransomware

    • BlackMatter Ransomware

      BlackMatter ransomware group claims to be Darkside and REvil succesor.

      ransomwareblackmatter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks