blackmatter | cf7ce60679a040ea33676e99968a7a8fa771f48c208b0ec6b19082741fba684c

General

Target

730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4.zip
Size

41KB
Sample

220711-wep27adhb2
MD5

b6f10c8529f2be5d15d98c2e57266c51
SHA1

4d250e7b17a396dee0fd43203b9ec09a518035c5
SHA256

cf7ce60679a040ea33676e99968a7a8fa771f48c208b0ec6b19082741fba684c
SHA512

b99bb6ee3e6dbcb822164ae6763b800ad4ef0bdecfdd83544cb01a2d1fcff73af774727456cb62ab7eeddeaf6531b25974b59b692596182c9c8a10452bb7b4fe

Score

10^/10

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

3e8e2ab5fbb392508535983b7446ba17

C2

https://fluentzip.org

http://fluentzip.org

Attributes

attempt_auth
false
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Path

C:\i7hzYmJzu.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. From your network was stolen more than 100 GB of data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/S2A4H6RGPHHLU1IJRLNTN >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/S2A4H6RGPHHLU1IJRLNTN

Targets

- Target
  
  730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4.exe
- Size
  
  80KB
- MD5
  
  5fe6daa399b18058f9b7e58fe31b4131
- SHA1
  
  1ed39024b03b3490049b4d6f2577ca36e18b405a
- SHA256
  
  730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4
- SHA512
  
  31baf91130c7e932068e12fec6dfde7ad283487b9f01b92e64835cf91aba1c4f51602066994a8200b73d219e6ea82929cde1f11ca82fb2a48af90418e57e324c
Score

10^/10

blackmatter ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

BlackMatter Ransomware

Modifies extensions of user files

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2