blackmatter | 73c07aa4bd216ebe870b332144fa8ec206bd518823c627a29ff7499bd65d9f4b

Resubmissions

05/02/2025, 11:25

250205-njccwswkap 10

24/06/2024, 18:49

240624-xgn4cazhpl 10

Sharing

Copy URL

Twitter E-mail

General

Target

22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.zip
Size

38KB
Sample

250205-njccwswkap
MD5

a673667a024d675ff980bb083fd0659b
SHA1

1dc4af0fb817c38c7c01c7731ec8c4ca52ebf360
SHA256

73c07aa4bd216ebe870b332144fa8ec206bd518823c627a29ff7499bd65d9f4b
SHA512

892147ee3943a55ab766f10bd5c3c30d040b478a9b05973597bb2490ddd50ef32c1a161d5314ceabb6a9de6f39a85084f25bc00e7c1739baa2cd9e10960e8a0f
SSDEEP

768:9r60vylcUdGrLHm/2V/8DgMQ2CEsbvy8MDeFdAE3Hn51+5i8OLQ5Ggpl4kb:kPBQfG+FM8rbvhFeU51OM05tl

Score

10^/10

Malware Config

Extracted

Family

blackmatter

Version

1.2

Botnet

512478c08dada2af19e49808fbda5b0b

Credentials

Username:
[email protected]
Password:
120Heisler

Username:
[email protected]
Password:
Tesla2019

Username:
[email protected]
Password:
iteam8**

https://paymenthacks.com

http://paymenthacks.com

https://mojobiden.com

http://mojobiden.com

Attributes

attempt_auth
true
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Path

C:\yHh8Ghp8e.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We have downloaded 1TB from your fileserver. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> Data leak includes 1. Full emloyeers personal data 2. Network information 3. Schemes of buildings, active project information, architect details and contracts, 4. Finance info >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV. >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/7NT6LXKC1XQHW5039BLOV

Targets

- Target
  
  22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.zip
- Size
  
  38KB
- MD5
  
  a673667a024d675ff980bb083fd0659b
- SHA1
  
  1dc4af0fb817c38c7c01c7731ec8c4ca52ebf360
- SHA256
  
  73c07aa4bd216ebe870b332144fa8ec206bd518823c627a29ff7499bd65d9f4b
- SHA512
  
  892147ee3943a55ab766f10bd5c3c30d040b478a9b05973597bb2490ddd50ef32c1a161d5314ceabb6a9de6f39a85084f25bc00e7c1739baa2cd9e10960e8a0f
- SSDEEP
  
  768:9r60vylcUdGrLHm/2V/8DgMQ2CEsbvy8MDeFdAE3Hn51+5i8OLQ5Ggpl4kb:kPBQfG+FM8rbvhFeU51OM05tl
Score

3^/10

discovery
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9
- Target
  
  22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
- Size
  
  67KB
- MD5
  
  598c53bfef81e489375f09792e487f1a
- SHA1
  
  80a29bd2c349a8588edf42653ed739054f9a10f5
- SHA256
  
  22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6
- SHA512
  
  6a82ad5009588d2fa343bef8d9d2a02e2e76eec14979487a929a96a6b6965e82265a69ef8dd29a01927e9713468de3aedd7b5ee5e79839a1a50649855a160c35
- SSDEEP
  
  1536:RzICS4AT6GxdEe+TOdincJXvKv8Zg3kl:qR7auJXSkZg3C
Score

10^/10

blackmatter discovery ransomware
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Blackmatter family
  blackmatter
- Renames multiple (190) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Targets

BlackMatter Ransomware

Blackmatter family

Renames multiple (190) files with added filename extension

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18