General
-
Target
BlackMatter-0xb.zip
-
Size
96KB
-
Sample
250404-a65q3azkt4
-
MD5
c417349192a4a75ba25bd4927f8b5044
-
SHA1
4eb9b4f0ea4ab8d7111e44ed8a79c0552b94ce2d
-
SHA256
4d58d127c08744c5f994ea70d558307a84d9f7a242907bb5f08fe6d376b34a2f
-
SHA512
48597c12fa528b59bfae86ec4124f9e173b5be0299a44d3ce27a2a764170ac16635a79ae11207f98fbfe5f17bdcfd04d986ef077810f984e4ee6d69cf650c556
-
SSDEEP
3072:9FrNOvVJ6QOouorHSpvSi9OAXJdIdFK8FEM:ZOtJ6QObp6i9DZOdFmM
Behavioral task
behavioral1
Sample
BlackMatter-0xb.exe
Resource
win10v2004-20250313-en
Malware Config
Extracted
C:\lH0RuaZei.README.txt
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
Targets
-
-
Target
BlackMatter-0xb.exe
-
Size
150KB
-
MD5
222eab3f409f97b1a3442411676ca689
-
SHA1
f10f511b30ce28a817a53228adf77a6e4dd80c8f
-
SHA256
3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61
-
SHA512
184a2f4696dceb401e9d0b6bbd2747f8dd005e708cd979f8cfffb60c49160ce7f834e29505a194f26ade68e0818683333a7d5dd7fe52f3d9d0469a429c40ed53
-
SSDEEP
3072:JqJogYkcSNm9V7DMNxr0+4SiK/OKr3qT:Jq2kc4m9tDMr0+4G/d
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-