blackmatter | 6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502

General

Target

3f9a28e8c057e7ea7ccf15a4db81f362
Size

2.0MB
Sample

240104-ccdrlaegdp
MD5

3f9a28e8c057e7ea7ccf15a4db81f362
SHA1

10d6d3c957facf06098771bf409b9593eea58c75
SHA256

6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502
SHA512

58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386
SSDEEP

49152:k5Wy/20shMXR8uUz9cBbLc/6LCM01iNFFB9wO:k5Wy//sO8uDq6

Score

10^/10

Malware Config

Extracted

Family

blackmatter

Version

1.6.0.2

Botnet

bab21ee475b52c0c9eb47d23ec9ba1d1

C2

http://paymenthacks.com

http://mojobiden.com

rsa_pubkey.plain

aes.plain

Extracted

Path

/var/log/ReadMe.txt

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your linux hosts are encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R. >> Warning! Recovery recommendations. Do not DELETE or MODIFY any files, it can lead to recovery problems!

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R

Targets

- Target
  
  3f9a28e8c057e7ea7ccf15a4db81f362
- Size
  
  2.0MB
- MD5
  
  3f9a28e8c057e7ea7ccf15a4db81f362
- SHA1
  
  10d6d3c957facf06098771bf409b9593eea58c75
- SHA256
  
  6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502
- SHA512
  
  58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386
- SSDEEP
  
  49152:k5Wy/20shMXR8uUz9cBbLc/6LCM01iNFFB9wO:k5Wy//sO8uDq6
Score

10^/10

ransomware
- Deletes itself
- Deletes log files
  Deletes log files on the system.
- Reads CPU attributes
behavioral1