General
-
Target
a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip
-
Size
284KB
-
Sample
220922-gjgt2sabf4
-
MD5
d8522e3ab793692681cd49d91cab93db
-
SHA1
f4cac00d0346c277804d42f843ddfa266eaf4cbd
-
SHA256
b09403adcaf79f3602815c242b3698e43138156d848ac1b0802232d4afc36154
-
SHA512
d53847879513f683eb6b7f03180f837a96d5f49ce7f534df4725dccd81236f76d4ff6bc25469d0ba2f839df3d3d8d49eed82a6e22b3ed7bdcd2d07b4cfa10397
-
SSDEEP
6144:MfUGa0n7gWHAUd6M3aVV2MlunD6xFqU4Mx0KgxMsDyEk:TGasH1d6saX2kU6bqkpgxMGk
Behavioral task
behavioral1
Sample
a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip
Resource
win10v2004-20220901-en
Malware Config
Extracted
blackmatter
25.239
Extracted
C:\62ZdIU5ix.README.txt
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Targets
-
-
Target
a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d.zip
-
Size
285KB
-
MD5
f871381769ec947b0028412b8e86669b
-
SHA1
1e11fb4df33528b64ce204283086d19eb25b01b3
-
SHA256
a5bb65afe22627fbf9526fd316d32c368a986a4d65af31814ef2c18cef18422d
-
SHA512
db7853e47eea3bd589e0fc1323e73ac8114da08aa0de90debd1afe33b56fc8a15f8b0a06b995a9943f946a945e9b147784c1b384d21c09a10e13393d252637cf
-
SSDEEP
6144:Jyk7CEChoKaMDst7kVns958jCBoFXTZUBO+zu/GlndySugs7y3a4H:JPfChoKLDy7kW9EXTZUTi4Upgs7qH
Score10/10-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-