blackmatter | e4fd947a781611c85ea2e5afa51b186de7f351026c28eb067ad70028acd72cda

General

Target

3317daace715dc332622d883091cf68b
Size

72KB
Sample

231231-mv42lsfchn
MD5

3317daace715dc332622d883091cf68b
SHA1

02fa74523198ebc1db490bdc6f10a78a44c4e28b
SHA256

e4fd947a781611c85ea2e5afa51b186de7f351026c28eb067ad70028acd72cda
SHA512

2739769ddd079b6555ebb84204f46bf94317ef5351734bd2aad74b1ad53738f92e3e278ea74b22f9b17db2219e01c963e694e6e1aec52a6089eaba394ef331b2
SSDEEP

1536:BICS4AgxwhjEO3r825exqkHYnKeGsXqsMt:q2SN3mxYnKr

Score

10^/10

Malware Config

Extracted

Family

blackmatter

Version

1.6

Botnet

0c6ca0532355a106258791f50b66c153

Attributes

attempt_auth
false
create_mutex
false
encrypt_network_shares
true
exfiltrate
false
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Path

C:\Users\BzOXaWmXM.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> Hello B&G International >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/RSW33BDOYPLWM78U9A09BZDI >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/RSW33BDOYPLWM78U9A09BZDI

Targets

- Target
  
  3317daace715dc332622d883091cf68b
- Size
  
  72KB
- MD5
  
  3317daace715dc332622d883091cf68b
- SHA1
  
  02fa74523198ebc1db490bdc6f10a78a44c4e28b
- SHA256
  
  e4fd947a781611c85ea2e5afa51b186de7f351026c28eb067ad70028acd72cda
- SHA512
  
  2739769ddd079b6555ebb84204f46bf94317ef5351734bd2aad74b1ad53738f92e3e278ea74b22f9b17db2219e01c963e694e6e1aec52a6089eaba394ef331b2
- SSDEEP
  
  1536:BICS4AgxwhjEO3r825exqkHYnKeGsXqsMt:q2SN3mxYnKr
Score

10^/10

blackmatter ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Renames multiple (182) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2