General

  • Target

    3f9a28e8c057e7ea7ccf15a4db81f362

  • Size

    2.0MB

  • Sample

    240104-ccdrlaegdp

  • MD5

    3f9a28e8c057e7ea7ccf15a4db81f362

  • SHA1

    10d6d3c957facf06098771bf409b9593eea58c75

  • SHA256

    6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502

  • SHA512

    58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386

  • SSDEEP

    49152:k5Wy/20shMXR8uUz9cBbLc/6LCM01iNFFB9wO:k5Wy//sO8uDq6

Malware Config

Extracted

Family

blackmatter

Version

1.6.0.2

Botnet

bab21ee475b52c0c9eb47d23ec9ba1d1

C2

http://paymenthacks.com

http://mojobiden.com

rsa_pubkey.plain
aes.plain

Extracted

Path

/var/log/ReadMe.txt

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your linux hosts are encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R. >> Warning! Recovery recommendations. Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R

Targets

    • Target

      3f9a28e8c057e7ea7ccf15a4db81f362

    • Size

      2.0MB

    • MD5

      3f9a28e8c057e7ea7ccf15a4db81f362

    • SHA1

      10d6d3c957facf06098771bf409b9593eea58c75

    • SHA256

      6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502

    • SHA512

      58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386

    • SSDEEP

      49152:k5Wy/20shMXR8uUz9cBbLc/6LCM01iNFFB9wO:k5Wy//sO8uDq6

    Score
    10/10
    • Deletes itself

    • Deletes log files

      Deletes log files on the system.

    • Reads CPU attributes

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

1
T1070

Discovery

System Information Discovery

1
T1082

Tasks