MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bf7dfc7534aec7b5ca71d147205d2b8a3ce113e5254bb342d9f9b69828cf8ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ransomware.BlackMatter


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7bf7dfc7534aec7b5ca71d147205d2b8a3ce113e5254bb342d9f9b69828cf8ee
SHA3-384 hash: 68959c0b42745a5c7c85f29e17a6da43b44f061861f31232d87bbf7dc4656e2ded6117369696e08c4a402374214ebf9e
SHA1 hash: af2791577a17bc0262824d859294ce6f2d785b57
MD5 hash: 7715b005583afa54fe25c1263f8d1289
humanhash: bravo-violet-snake-hamper
File name:Document.zip
Download: download sample
Signature Ransomware.BlackMatter
Create hunting rule
File size:15'897 bytes
First seen:2024-04-29 12:53:10 UTC
Last seen:2024-04-30 06:17:06 UTC
File type: zip
MIME type:application/zip
ssdeep 384:dvpy69yWlKA0tskALQF/3/VeL8imATY7PgsS0XXxYWy:VpyFw0gsFP/Veh0zg2Xzy
TLSH T10B62D0400DFE883AC474BB69A986DD11F6E7013F4A925926373FC83B9C6C2799692464
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:Ransomware.BlackMatter zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Jenny Green <Jenny@gsd.com>" (likely spoofed)
Received: "from [185.80.226.142] (unknown [185.80.226.142]) "
Date: "Mon, 29 Apr 2024 19:38:21 +0200"
Subject: "Your Document"
Attachment: "Document.zip"

Intelligence

File Origin
# of uploads :
260
# of downloads :
236
Origin country :
CH CH
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:101
File size:118 bytes
SHA256 hash: 2e89015d37a9697b226e1a477b32472a7bea3d5451189e71b65d84d0c2f4c2a7
MD5 hash: ef2cc7358c7350cabfc7460c303d827c
MIME type:application/octet-stream
Signature Ransomware.BlackMatter
File name:Document.doc.scr
File size:58'880 bytes
SHA256 hash: ddbc4908272a1d0f339b58627a6795a7daff257470741474cc9203b9a9a56cd6
MD5 hash: 273d4bf4641d75dbcf2995eb614a4f51
MIME type:application/x-dosexec
Signature Ransomware.BlackMatter
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm masquerade obfuscated
Link:
https://www.filescan.io/uploads/662f986f14fabb16f403aa17/reports/e6ca6708-aa0f-453c-99e4-c92bf069b2f1/overview
Verdict:
Malicious
Labled as:
HIDDENEXT/Worm.Generic
Link:
https://www.hybrid-analysis.com/sample/7bf7dfc7534aec7b5ca71d147205d2b8a3ce113e5254bb342d9f9b69828cf8ee
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/7bf7dfc7534aec7b5ca71d147205d2b8a3ce113e5254bb342d9f9b69828cf8ee
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
54%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/7bf7dfc7534aec7b5ca71d147205d2b8a3ce113e5254bb342d9f9b69828cf8ee
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7bf7dfc7534aec7b5ca71d147205d2b8a3ce113e5254bb342d9f9b69828cf8ee/
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2024-04-29 12:12:41 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
21 of 37 (56.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pp357r2tjlwhwxfhdukhebosxcr44ej6kjklwnbnt6nwtaum7dxa._file
Result
Malware family:
lockbit
Create hunting rule
Score:
  10/10
Tags:
family:lockbit ransomware spyware stealer
Link:
https://tria.ge/reports/240429-qmtgpabh6w/
Behaviour
Modifies Control Panel
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops desktop.ini file(s)
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Renames multiple (267) files with added filename extension
Lockbit
Rule to detect Lockbit 3.0 ransomware Windows payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7bf7dfc7534aec7b5ca71d147205d2b8a3ce113e5254bb342d9f9b69828cf8ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Ransomware.BlackMatter

zip 7bf7dfc7534aec7b5ca71d147205d2b8a3ce113e5254bb342d9f9b69828cf8ee

(this sample)

BlackMatter

Executable exe ddbc4908272a1d0f339b58627a6795a7daff257470741474cc9203b9a9a56cd6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ddbc4908272a1d0f339b58627a6795a7daff257470741474cc9203b9a9a56cd6
  
Dropping
Ransomware.BlackMatter
  
Dropping
MD5 273d4bf4641d75dbcf2995eb614a4f51

Comments