MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackMatter


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800
SHA3-384 hash: 6d17163b42e9d88255ac1286e2cf39ed3fc891627c5c0f3aeb331b0e7384fa4a9912d1baceab932eeb9c66b09bb48eab
SHA1 hash: 142a60359f83657ba56a0365956d18c29e433605
MD5 hash: b13b11e5b192fb6e6bc13e93a160da36
humanhash: nebraska-spring-bluebird-triple
File name:file
Download: download sample
Signature BlackMatter
Create hunting rule
File size:149'504 bytes
First seen:2026-01-23 07:03:49 UTC
Last seen:2026-01-23 16:24:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 41fb8cb2943df6de998b35a9d28668e8 (82 x BlackMatter, 9 x LockBit, 1 x DragonForce)
ssdeep 3072:z6glyuxE4GsUPnliByocWepKjM8wmxlbg8WTGIThR:z6gDBGpvEByocWecjM8w4lbgzfdR
TLSH T1B5E36C21F212D0B3C87718F12736B5B2F39E8D6C19A56807EAD80F9DBC648232F55697
TrID 25.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
19.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.1% (.EXE) Win32 Executable (generic) (4504/4/1)
7.8% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.8% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter Bitsight
Tags:BlackMatter dropped-by-phorpiex exe


Avatar
Bitsight
url: http://195.178.136.19/37.exe

Intelligence

File Origin
# of uploads :
18
# of downloads :
130
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
LockBit
Details
LockBit
a PCG-lockbit seed, a RSA public key modulus, flags, hashes for excluded folders, files, and extensions, hashes for computer names, killed processes and services, a list of credentials, a ransom note, and information parsed from the ransom note
Link:
https://research.acce.ciphertechsolutions.com/results/011ae1c2-fed1-4afe-a491-8ab7cbb0f9df/
Malware family:
lockbit
Create hunting rule
ID:
1
File name:
file.exe
Verdict:
Malicious activity
Analysis date:
2026-01-23 07:08:34 UTC
Tags:
lockbit ransomware auto-download braincipher darkside arch-scr
Link:
https://app.any.run/tasks/91638d3e-0990-49bc-9801-7da582e0e586

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/49863/
Detection(s):
Win.Ransomware.LockBitBlack-10033143-1
Create hunting rule

Win.Ransomware.BlackMatter-9965914-0
Create hunting rule

Win.Ransomware.Lazy-10003135-0
Create hunting rule

SecuriteInfo.com.Trojan.Encoder.42541.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69731dbcf3cf908ba5079faf
Tags:
spawn
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/69731d7855805a763ff1f60c/reports/fb3e323c-2d0f-4caa-8e10-67f514915612/overview
Verdict:
Malicious
Labled as:
Trojan.Ransom
Link:
https://www.hybrid-analysis.com/sample/1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800
Result
Gathering data
Verdict:
Unknown
File Type:
Link:
https://opentip.kaspersky.com/1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800/results?tab=lookup
Malware family:
BlackMatter Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3cdc8c83-b9f6-4bd9-ae22-24939db6ee23
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/b13b11e5b192fb6e6bc13e93a160da36
Detection:
lockbit
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800/
Verdict:
Malicious
Threat:
Family.LOCKBIT
Link:
https://tip.neiki.dev/file/1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cwe7yw6wwqyp53dcyyszctmu647cmhsfmvpzr6cvh7o2ocgrfaaa._file
Verdict:
malicious
Label(s):
lockbit
Create hunting rule
Similar samples:
error
BlackMatter
Result
Malware family:
lockbit
Create hunting rule
Score:
  10/10
Tags:
family:lockbit defense_evasion discovery ransomware spyware stealer
Link:
https://tria.ge/reports/260123-hwbdgaet3f/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Control Panel
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in System32 directory
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops desktop.ini file(s)
Enumerates connected drives
Indicator Removal: File Deletion
Checks computer location settings
Deletes itself
Executes dropped EXE
Reads user/profile data of web browsers
Renames multiple (631) files with added filename extension
Unpacked files
SH256 hash:
1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800
MD5 hash:
b13b11e5b192fb6e6bc13e93a160da36
SHA1 hash:
142a60359f83657ba56a0365956d18c29e433605
Link:
https://www.unpac.me/results/231a5df6-9129-41a5-ba1f-4598973a50dd/
Malware family:
LockBit
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1589fc5bd6b4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CRIME_WIN32_RANSOM_BLACKMATTER
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects Blackmatter ransomware
Rule name:Darkside
Create hunting rule
Author:@bartblaze
Description:Identifies Darkside ransomware.
Rule name:lb_stack_string_decrypt_1
Create hunting rule
Author:CTI Purple Team
Description:This rule detects the code pattern of the Stack Strings decryption algorithm.
Rule name:Windows_Ransomware_Lockbit_369e1e94
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BlackMatter

Executable exe 1589fc5bd6b430feec62c625914d94f73e261e45655f98f8553fdda708d12800

(this sample)

  
Dropped by
Phorpiex
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3762453/
Cape
Cape
https://www.capesandbox.com/analysis/49863/

Comments