blackmatter | bc898ce6307318c512fc3ca7650dfc581ff7097953aca026efd994a3882d95f5

General

Target
LockBit_LockBit.rar
Size 158KB
Sample261111-ned1xsft8k
SHA256 bc898ce6307318c512fc3ca7650dfc581ff7097953aca026efd994a3882d95f5
MD5 82e20252256fb046ad55fa6e71503efc
SHA1 b5413b354ebda4bf0e54e66a5c1cda73bee5a928
SHA512 18c2404cb3bcff6156ac705d2b95c6684744200fbeec433130bd545eee2ff570f2e4423e9b2fc88900f313096c0a2dc21656c7b22019a0e2bdfa69b7848b897e
SSDEEP 3072:r4dfK+rboXzrXVH8K3s6DUCDXFRYgjrjKU8JGnhT4NZtuqzmGvWlRq528I9fOUL1:rQbrboXzrFHocPXXnjKUW08uemEqRq5y
TLSH
T1F2F312CF3C1D7004E823F88CF275C9229AF953C55B1B946B906A136A79A907B30C7B75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

blackmatter

Version

25.239

Targets

- Target
  LockBit/Build.bat
- Size 767B
- SHA256 7f6528ce5ebb8dcf7598d26d606db1d7f6419593ce589af363a4fcb18668f2b0
- MD5 0173b6cb7d6c8c41e73f8a6518a089d8
- SHA1 790d4a3d7db86aa8ebb8c4af2a8d138266164643
- SHA512 ebe66e432e7693b2d5851f4c08d5289e2b5364d1bf327a1ba912d49e5b5cf3fa03886d30d2abc747747899451ff9db02e830566c61eb3708614e903aba45d7df
- TLSH
  T187014873C08958B358779C48A5F1DB16FFAF3BC68AC3808DD91C763D5226022173629B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral1 behavioral2
- Target
  LockBit/builder.exe
- Size 469KB
- SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
- MD5 c2bc344f6dde0573ea9acdfb6698bf4c
- SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
- SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0
- SSDEEP 12288:CzVXpdg/1MB94JD7RfaVT1hG98P67PNV3giFH6J1VjR3L6dpbQrQyEpInmwuRUfB:CzxjgdRpBq1hG98P67PNV3giFH6J1Vjn
- TLSH
  T10EA48D11B225D073D07714F67B6BB129B3AF4D3C0A796803EAD41F0938B59A3AF11A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  LockBit/keygen.exe
- Size 31KB
- SHA256 ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37
- MD5 71c3b2f765b04d0b7ea0328f6ce0c4e2
- SHA1 bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4
- SHA512 1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035
- SSDEEP 768:A6+T41GjHbdWCWDwDD01riWpJxKpAQJs/3JGIDLQ5:b+U+hHIBpJxixgQ
- TLSH
  T1A2E2F6439695B8B7D47693B2322BC6FD8DF10D16026F667B0B3FF8701932C429B24699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6