LB3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0a1eb4dbe281ad9115aa909ba8cbe84eb7c8c06a5253b7fbea3a79d8d04edc63
-
Unsigned PE
Checks for missing Authenticode signature.
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win11-20260513-en
blackmatter
sql, oracle, ocssd, dbsnmp, synctime, agntsvc, isqlplussvc, xfssvccon, mydesktopservice, ocautoupds, encsvc, firefox, tbirdconfig, mydesktopqos, ocomm, dbeng50, sqbcoreservice, excel, msaccess, mspub, onenote, outlook, powerpnt, thebat, thunderbird, visio, winword, wordpad, notepad, bedbh, vxmon, benetns, bengien, pvlsvr, beserver, raw_agent_svc, vsnapvss, CagService, QBIDPService, QBDBMgrN, QBCFMonitorService, SAP, TeamViewer_Service.exe, TeamViewer.exe, tv_w32.exe, tv_x64.exe, CVMountd, cvd, cvfwd, CVODS, saphostexec, saposcol, sapstartsrv, avagent, avscc, DellSystemDetect, EnterpriseClient, VeeamNFSSvc, VeeamTransportSvc, VeeamDeploymentSvc
vss, sql, sql$, mysql, mysql$, svc$, memtas, mepocs, sophos, veeam, backup, MSExchange, MSExchange$, WSBExchange, PDVFSService, BackupExecVSSProvider, BackupExecAgentAccelerator, BackupExecAgentBrowser, BackupExecDiveciMediaService, BackupExecJobEngine, BackupExecManagementService, BackupExecRPCService, GxBlr, GxVss, GxClMgrS, GxCVD, GxCIMgr, GXMMM, GxVssHWProv, GxFWD, SAPService, SAP, SAP$, SAPD$,SAPHostControl, SAPHostExec, QBCFMonitorService, QBDBMgrN, QBIDPService, AcronisAgent, VeeamNFSSvc, VeeamDeploymentService, VeeamTransportSvc, MVArmor, MVarmor64, VSNAPVSS, AcrSch2Svc
carbonblack, crowdstrike, defender, symantec, mcafee, kaspersky, trendmicro
CarbonBlack, CrowdStrike, WinDefend, Symantec, McAfee, Kaspersky, TmCCSF
.doc, .pdf, .txt, .sql, .db, .csv, .xlsx, .pptx, .odt, .rtf, .md, .xml, .json, .yaml, .ini, .log, .htm, .html, .mdb, .accdb, .dbf, .sqlite, .sqlite3, .db3, .sqlitedb, .db2, .ldb, .mdf, .ldf, .btr, .cpt, .dc, .dbs, .fpt, .gdb, .index, .ism, .lck, .ma, .map, .mbd, .myd, .mydb, .ndf, .sql, .sdf, .tbd, .tbr, .tbl, .tdf, .vdf, .vdm, .vdmx, .vdx, .vdxx, .vfb, .vft, .vhd, .vhx, .vhz, .vmd, .vmdx, .vms, .vmx, .vnb, .vnd, .vnp, .vnt, .vnx, .vny, .voc, .vor, .vot, .voy, .vpf, .vpl, .vqf, .vsn, .vst, .vtd, .vtf, .vtp, .vtr, .vtx, .vui
#Clowned ahahahahha
>>> What happens?
Your network is encrypted, and currently not operational.
We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data.
>>> What guarantees?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption and we will delete your data.
If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals.
We always keep our promises.
>>> How to contact with us?
1. Download and install Telegram
2. type in browser t.me/nigerxd
>>> Warning! Recovery recommendations.
We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
BlackMatter ransomware group claims to be Darkside and REvil succesor.
Checks for missing Authenticode signature.
| resource |
|---|
| LB3.exe |
Unsigned PE
Checks for missing Authenticode signature.