blackmatter | eb5965f0e5dfe75357019ecc6e18b231b44d32c6d2f5fbf92c15020090e9120d

General

Target

c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da.7z
Size

320KB
Sample

241111-yh4qvstngz
MD5

0ae1786f245b0f9f3c56b840f9e66ca4
SHA1

5f169c9e72799cef0f6b2d6b16b05822a76b829b
SHA256

eb5965f0e5dfe75357019ecc6e18b231b44d32c6d2f5fbf92c15020090e9120d
SHA512

dde9821026628656442202190ce56dd9497aaa364339fc32e4368c7d2dccc474543f37ef8f62afbbf3288b53e89e8afc27839b12dc4aafdcc77ef01ef879288a
SSDEEP

6144:MaQ0EImY93tS6MK3RqnllYePv3Buo91IOmrI6Uu4gDD6nZ+clLQHYejbU7eXA7Ez:fES938U3RqbYavPHmkmDPyLQHVXBz

Score

10^/10

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

a89e0e2e31db3e31a1e7a9630375f437

C2

https://fluentzip.org

http://fluentzip.org

Attributes

attempt_auth
false
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Path

F:\ogFRBgZRA.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O1E1HJ9H8JNKNNHC8 >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/O1E1HJ9H8JNKNNHC8

Targets

- Target
  
  c22a6401a415fe642f3d96f38a887dd8ad23dd83a9255ee89d9adf4650ab98da.7z
- Size
  
  320KB
- MD5
  
  0ae1786f245b0f9f3c56b840f9e66ca4
- SHA1
  
  5f169c9e72799cef0f6b2d6b16b05822a76b829b
- SHA256
  
  eb5965f0e5dfe75357019ecc6e18b231b44d32c6d2f5fbf92c15020090e9120d
- SHA512
  
  dde9821026628656442202190ce56dd9497aaa364339fc32e4368c7d2dccc474543f37ef8f62afbbf3288b53e89e8afc27839b12dc4aafdcc77ef01ef879288a
- SSDEEP
  
  6144:MaQ0EImY93tS6MK3RqnllYePv3Buo91IOmrI6Uu4gDD6nZ+clLQHYejbU7eXA7Ez:fES938U3RqbYavPHmkmDPyLQHVXBz
Score

10^/10

blackmatter a89e0e2e31db3e31a1e7a9630375f437 discovery execution ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Blackmatter family
  blackmatter
- Renames multiple (155) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1