blackmatter | ecdb0aac31e29d0fd369342965a1bc5880ac951ade510ef947c592edb5828f53

General

Target

2024-03-21_cdbb4fff55080101d27e5072025557bd_blackmatter_darkside
Size

67KB
Sample

240321-zhl2gshh29
MD5

cdbb4fff55080101d27e5072025557bd
SHA1

bfe246551ac1b8fa50d75ab16f30df1f4ae57efc
SHA256

ecdb0aac31e29d0fd369342965a1bc5880ac951ade510ef947c592edb5828f53
SHA512

38c5f3ccdfdda988722ada0ada508153b0db0b62fcb7cb7782ed76005546be765f53d5ae1e98cfc411752571585c467f369c1068929c098cb371dd085ac82f0c
SSDEEP

1536:RzICS4AT6GxdEe+TOdincJXvKvSZg3kl:qR7auJXSqZg3C

Score

10^/10

blackmatter ransomware

Malware Config

Extracted

Path

C:\Sl7OiPzOX.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We have downloaded 1TB from your fileserver. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> Data leak includes 1. Full emloyeers personal data 2. Network information 3. Schemes of buildings, active project information, architect details and contracts, 4. Finance info >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV. >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV

Targets

- Target
  
  2024-03-21_cdbb4fff55080101d27e5072025557bd_blackmatter_darkside
- Size
  
  67KB
- MD5
  
  cdbb4fff55080101d27e5072025557bd
- SHA1
  
  bfe246551ac1b8fa50d75ab16f30df1f4ae57efc
- SHA256
  
  ecdb0aac31e29d0fd369342965a1bc5880ac951ade510ef947c592edb5828f53
- SHA512
  
  38c5f3ccdfdda988722ada0ada508153b0db0b62fcb7cb7782ed76005546be765f53d5ae1e98cfc411752571585c467f369c1068929c098cb371dd085ac82f0c
- SSDEEP
  
  1536:RzICS4AT6GxdEe+TOdincJXvKvSZg3kl:qR7auJXSqZg3C
Score

10^/10

blackmatter ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Renames multiple (149) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Tasks

Sharing

General

Malware Config

Extracted

Targets

BlackMatter Ransomware

Renames multiple (149) files with added filename extension

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2