Overview

overview

10

Static

static

10

730f2d6243...a4.exe

windows7_x64

10

730f2d6243...a4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4.zip

  • Size

    41KB

  • Sample

    220711-wep27adhb2

  • MD5

    b6f10c8529f2be5d15d98c2e57266c51

  • SHA1

    4d250e7b17a396dee0fd43203b9ec09a518035c5

  • SHA256

    cf7ce60679a040ea33676e99968a7a8fa771f48c208b0ec6b19082741fba684c

  • SHA512

    b99bb6ee3e6dbcb822164ae6763b800ad4ef0bdecfdd83544cb01a2d1fcff73af774727456cb62ab7eeddeaf6531b25974b59b692596182c9c8a10452bb7b4fe

Score
10/10
blackmatter3e8e2ab5fbb392508535983b7446ba17ransomware

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

3e8e2ab5fbb392508535983b7446ba17

C2

https://fluentzip.org

http://fluentzip.org
Attributes
  • attempt_auth

    false

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Extracted

Path

C:\i7hzYmJzu.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. From your network was stolen more than 100 GB of data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/S2A4H6RGPHHLU1IJRLNTN >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/S2A4H6RGPHHLU1IJRLNTN

Targets

    • Target

      730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4.exe

    • Size

      80KB

    • MD5

      5fe6daa399b18058f9b7e58fe31b4131

    • SHA1

      1ed39024b03b3490049b4d6f2577ca36e18b405a

    • SHA256

      730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4

    • SHA512

      31baf91130c7e932068e12fec6dfde7ad283487b9f01b92e64835cf91aba1c4f51602066994a8200b73d219e6ea82929cde1f11ca82fb2a48af90418e57e324c

    Score
    10/10
    blackmatterransomware

    • BlackMatter Ransomware

      BlackMatter ransomware group claims to be Darkside and REvil succesor.

      ransomwareblackmatter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks