General

  • Target

    3f328e68ed4d59973f9c5b4f36545ab0

  • Size

    2.0MB

  • Sample

    240103-2g4w1sbgej

  • MD5

    3f328e68ed4d59973f9c5b4f36545ab0

  • SHA1

    f2724c0abb93b6a1d3f6fcb59b88c2aebbd76031

  • SHA256

    1247a68b960aa81b7517c614c12c8b5d1921d1d2fdf17be636079ad94caf970f

  • SHA512

    905834e82f0144db00dcb49078792beb7c595dd0fca1937aace49be430919f6a43b84f239c46f9e9bd5e494c49eb5f4e3c18ad494eb311c44e5704e715a0d10d

  • SSDEEP

    49152:k5Wy/20shMXR8uUz9cBbLc/6LCM01iNFFB9nO:k5Wy//sO8uDq6

Malware Config

Extracted

Family

blackmatter

Version

1.6.0.2

rsa_pubkey.plain

Extracted

Path

/var/log/ReadMe.txt

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your linux hosts are encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV >> Warning! Recovery recommendations. Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV

Targets

    • Target

      3f328e68ed4d59973f9c5b4f36545ab0

    • Size

      2.0MB

    • MD5

      3f328e68ed4d59973f9c5b4f36545ab0

    • SHA1

      f2724c0abb93b6a1d3f6fcb59b88c2aebbd76031

    • SHA256

      1247a68b960aa81b7517c614c12c8b5d1921d1d2fdf17be636079ad94caf970f

    • SHA512

      905834e82f0144db00dcb49078792beb7c595dd0fca1937aace49be430919f6a43b84f239c46f9e9bd5e494c49eb5f4e3c18ad494eb311c44e5704e715a0d10d

    • SSDEEP

      49152:k5Wy/20shMXR8uUz9cBbLc/6LCM01iNFFB9nO:k5Wy//sO8uDq6

    Score
    10/10
    • Deletes itself

    • Deletes log files

      Deletes log files on the system.

    • Reads CPU attributes

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

1
T1070

Discovery

System Information Discovery

1
T1082

Tasks