MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackMatter


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57
SHA3-384 hash: a469db8a0f7161ad467e9d7394cf292de43e2b2bccfecfb5cdc80a43d49c46b807fe23d01bfa97b1a703914a0ffa9fe8
SHA1 hash: 721a749cbd6afcd765e07902c17d5ab949b04e4a
MD5 hash: 50c4970003a84cab1bf2634631fe39d7
humanhash: kansas-fix-uncle-four
File name:520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57
Download: download sample
Signature BlackMatter
Create hunting rule
File size:79'872 bytes
First seen:2021-08-18 15:22:13 UTC
Last seen:2021-08-18 16:10:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e4ae81fc349a1616df79a6f5499743f (3 x BlackMatter)
ssdeep 1536:7nICS4ArFnRoHhcVyid9EZZoi+zQsgoZ2GwrCN:4ZnmqVyq9EN+MzW
Threatray 10 similar samples on MalwareBazaar
TLSH T199735A1430629037E4921AF3A69D37D8BB29AE7C09A574BBFDE41F042967413BF2049F
Reporter sisoma2
Tags:BlackMatter exe V2


Avatar
sisoma2
BlackMatter version 2.0

Intelligence

File Origin
# of uploads :
2
# of downloads :
374
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57
Verdict:
Malicious activity
Analysis date:
2021-08-18 15:25:27 UTC
Tags:
trojan ransomware
Link:
https://app.any.run/tasks/36b77b62-9ff4-4449-9840-1a3688263955

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Blackmatter
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180390/
Detection(s):
SecuriteInfo.com.Trojan.Encoder.34258.28306.21546.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BlackMatter Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/600bab5c-f7d0-459f-9dd5-91c1acd53c27
Result
Threat name:
BLACKMatter
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/835184
Signature
Antivirus / Scanner detection for submitted sample
Changes the wallpaper picture
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found ransom note / readme
Found Tor onion address
Hides threads from debuggers
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes a notice file (html or txt) to demand a ransom
Yara detected BLACKMatter Ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57/
Threat name:
Win32.Ransomware.MintZard
Create hunting rule
Status:
Malicious
First seen:
2021-08-17 22:31:45 UTC
AV detection:
27 of 46 (58.70%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kif5t3larrtiqeexdw6vcgcmniuydftufafqddoeaj54hd6efzlq._file
Verdict:
malicious
Similar samples:
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6
BlackMatter
7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984
BlackMatter
b824bbc645f15e213b4cb2628f7d383e9e37282059b03f6fe60f7c84ea1fed1f
BlackMatter
c6e2ef30a86baa670590bd21acf5b91822117e0cbe6060060bc5fe0182dace99
BlackMatter
daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720
BlackMatter
Result
Malware family:
blackmatter
Create hunting rule
Score:
  10/10
Tags:
family:blackmatter ransomware
Link:
https://tria.ge/reports/210818-plt6eyj47e/
Behaviour
Modifies Control Panel
Modifies registry class
Opens file in notepad (likely ransom note)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates connected drives
Modifies extensions of user files
BlackMatter Ransomware
Unpacked files
SH256 hash:
520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57
MD5 hash:
50c4970003a84cab1bf2634631fe39d7
SHA1 hash:
721a749cbd6afcd765e07902c17d5ab949b04e4a
Link:
https://www.unpac.me/results/4a4f75d7-1bb5-4e6b-a49c-25914b679510/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Darkside
Create hunting rule
Author:@bartblaze
Description:Identifies Darkside ransomware.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/180390/

Comments