blackmatter | 4e6405d10d2d72343f398a0bd8b60fc3084926c6597008337ca2468b3c75f4c3

Sharing

Copy URL Twitter E-mail

General

Target
EXTRA.7z
Size 20.3MB
Sample250917-2rd4catqs4
SHA256 4e6405d10d2d72343f398a0bd8b60fc3084926c6597008337ca2468b3c75f4c3
MD5 db17c72e2bfe35cf2497a8016fe397e3
SHA1 9fe3dfa0829a914317226e3b08a3eb346df4e8dc
SHA512 d0a0f566bea85f5f1ee2747ffef24730942878976af13de76259014440fcce524c6274b73a8b4d97219225ab801591cbb17d68de5ee8ee6076c06fea26612232
SSDEEP 393216:mv6xwLCF+OdcKMaJVYpxyst6XEp+RW2QMtqPoUeByubwU14wsZQ0e:6qnPd9rYDL0Z7tj101Be
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

gandcrab

http://gdcbghvjyqy7jclk.onion.top/

Extracted

Path

C:\Recovery\Help Restore Your Files.txt

Ransom Note

ATTENTION! Gentlemen! Your business is at serious risk. There is a significant flaw in your company's security system. We easily penetrate your network. You should thank the Lord that you were invaded by serious people, not some stupid students or dangerous punks. They can damage all your important data just for fun. Now your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Nobody can help you restore files without our special decoder. The only file recovery method is to buy a decryption tool and an exclusive key for you Delta Plus 2.4 version. This software will decrypt all your encrypted files. What guarantees do you have? Free decryption as a guarantee You can send us up to 1 file for free decryption. The file size must be less than 1 Mb (not archived). We do not decrypt for testing DATABASE, XLS and other important files. Remember this. decoding cost The cost of decryption is $10,500 USD. We only receive payment in BITCOINS. (Bitcoin is a form of digital currency) 50% discount available if you contact us within the first 72 hours, the price for you is $5250 USD. Each day of delay will cost you an additional $100 nothing personal just business contact emails [email protected] or [email protected] Value First 72 hours: $5250 USD. Bitcoin Address: 3JG36KY6abZTnHBdQCon1hheC3Wa2bdyqs No system is secure

Emails

Wallets

3JG36KY6abZTnHBdQCon1hheC3Wa2bdyqs

Extracted

Family

blackmatter

Version

Botnet

4e591a315c54e8800dae714320555fa5

Credentials

Username
[email protected]
Password
yhU6VJ$&amp

Credentials

Username
[email protected]
Password
RPo@ndf9

Credentials

Username
[email protected]
Password
DH5U87@rA0ELa2

https://fluentzip.org
http://fluentzip.org

Attributes

attempt_auth
true
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-707770698-2523217751-1187874351-1000\!_INFO.txt

Ransom Note

WARNING! YOUR FILES ARE ENCRYPTED! Don’t worry, your files are safe, provided that you are willing to pay the ransom. Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently! The only way to decrypt your files safely is to buy the special decryption software from us. Before paying you can send us up to 2 files for free decryption as guarantee. Send pictures, text files. (files no more than 1mb) You can contact us with the following email [email protected] [email protected] Send us this ID or this file in first email ID: 5AO963cb0e5GvL2Va31bv6NW4n7yN5APKBf5a3Sl1zI=:0560a3dbd08deca76d7adaa42b25e0c223a0e54d094a8f8e29302ec8998fc783

Emails

Extracted

Path

C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset='utf-8'> <meta name='viewport' content='width=device-width,initial-scale=1'> <title></title> <style> html, body { background-color: #1a1a1a; } body { padding-top: 1rem !important; font-size: 1.3rem; color: white; } #text h2 { font-size: 2rem; font-weight: 600; line-height: 1.125; } .container { max-width: 1152px; flex-grow: 1; margin: 0 auto; position: relative; width: auto; } .box { background-color: #242424; display: block; padding: 1.25rem; border: 1px solid #303030; } a { color: #00b4d8; text-decoration: none; } a:hover { text-decoration: underline; } li { margin-bottom: 10px; } </style> </head> <body> <div class='container'> <div class='box'> <div id='text'> <h2>If you get this message, your network was hacked!</h2> <p>After we gained full access to your servers, we first downloaded a large amount of sensitive data and then encrypted all the data stored on them.</p> <p>That includes personal information on your clients, partners, your personnel, accounting documents, and other crucial files that are necessary for your company to work normally.</p> <p>We used modern complicated algorithms, so you or any recovery service will not be able to decrypt files without our help, wasting time on these attempts instead of negotiations can be fatal for your company.</p> <p>Make sure to act within <span style='color:#f4a261;'>72</span> hours or the negotiations will be considered failed!</p> <p>Inform your superior management about what's going on, invite someone who is authorized to solve financial issues to our private chat. To get there you should download and install <a href='https://www.torproject.org/download/'>TOR browser</a> and follow the link below:</p> <a href="http://sttzxdr7uofos6f5koi644dv2xash7ope5x2yrat6fmhyvywigzc3eqd.onion/chat.html?426dd6f696-7e6bc490e0-85148013d5-47ee01a014-7c2232ecf4-d874e1d4fb-7ace664dae-2cbcfbc088">http://sttzxdr7uofos6f5koi644dv2xash7ope5x2yrat6fmhyvywigzc3eqd.onion/chat.html?426dd6f696-7e6bc490e0-85148013d5-47ee01a014-7c2232ecf4-d874e1d4fb-7ace664dae-2cbcfbc088</a> <h2>If you and us succeed the negotiations we will grant you:</h2> <ul> <li>complete confidentiality, we will keep in secret any information regarding to attack, your company will act as if nothing had happened.</li> <li>comprehensive information about vulnerabilities of your network and security report.</li> <li>software and instructions to decrypt all the data that was encrypted.</li> <li>all sensitive downloaded data will be permanently deleted from our cloud storage and we will provide an erasure log.</li> </ul> <h2>Our options if you act like nothing's happening, refuse to make a deal or fail the negotiations:</h2> <ul> <li>inform the media and independent journalists about what happened to your servers. To prove it we'll publish a chunk of private data that you should have ciphered if you care about potential breaches. Moreover, your company will inevitably take decent reputational loss which is hard to assess precisely.</li> <li>inform your clients, employees, partners by phone, e-mail, sms and social networks that you haven't prevent their data leakage. You will violate laws about private data protection.</li> <li>start DDOS attack on you website and infrastructures.</li> <li>personal data stored will be put on sale on the Darknet to find anyone interested to buy useful information regarding your company. It could be data mining agencies or your market competitors.</li> <li>publish all the discovered vulnerabilities found in your network, so anyone will do anything with it.</li> </ul> <h2>Why pay us?</h2> <p>We care about our reputation. You are welcome to google our cases up and be sure that we don't have a single case of failure to provide what we promissed.</p> <p>Turning this issue to a bug bounty will save your private information, reputation and will allow you to use the security report and avoid this kind of situations in future.</p> </div> </div> </div> </body> </html>��

Extracted

Path

C:\Users\QJx7CQl7n.README.txt

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What data stolen? From your network was stolen large amount of data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/U6H6RKDF6W3B8XOWL >> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/U6H6RKDF6W3B8XOWL

Targets

- Target
  EXTRA.7z
- Size 20.3MB
- SHA256 4e6405d10d2d72343f398a0bd8b60fc3084926c6597008337ca2468b3c75f4c3
- MD5 db17c72e2bfe35cf2497a8016fe397e3
- SHA1 9fe3dfa0829a914317226e3b08a3eb346df4e8dc
- SHA512 d0a0f566bea85f5f1ee2747ffef24730942878976af13de76259014440fcce524c6274b73a8b4d97219225ab801591cbb17d68de5ee8ee6076c06fea26612232
- SSDEEP 393216:mv6xwLCF+OdcKMaJVYpxyst6XEp+RW2QMtqPoUeByubwU14wsZQ0e:6qnPd9rYDL0Z7tj101Be
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

backdoor 4e591a315c54e8800dae714320555fa5 defense_evasion discovery execution blackmatter chaos dcrat gandcrab mafiaware666 venus impact infostealer persistence ransomware rat spyware stealer trojan upx
- BlackMatter Ransomware
  BlackMatter ransomware group claims to be Darkside and REvil succesor.
  ransomware blackmatter
- Blackmatter family
  blackmatter
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Chaos family
  chaos
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Detect MafiaWare666 ransomware
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- MafiaWare666 Ransomware
  MafiaWare666 is ransomware written in C# with multiple variants.
  ransomware mafiaware666
- Mafiaware666 family
  mafiaware666
- Modifies WinLogon for persistence
  persistence
- Venus
  Venus is a ransomware first seen in 2022.
  ransomware venus
- Venus Ransomware
- Venus family
  venus
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (3632) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1