MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BlackMatter

Vendor detections: 9

Intelligence 9 IOCs YARA 7 File information Comments

SHA256 hash:	d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15
SHA3-384 hash:	930524eec4793e15cf4939a3b3fad6b1b96c7432d10fdcde3f1ab49fc0584ec3c29772cf903264ac8072b12446ecffaa
SHA1 hash:	2502cd18ad7db0536b3950bdbd66bf6cae488811
MD5 hash:	6dfd06fe70cb840c97edb292ac4272ca
humanhash:	mike-rugby-fix-mirror
File name:	Document.zip
Download:	download sample
Signature	BlackMatter Create hunting rule
File size:	104'824 bytes
First seen:	2024-04-26 06:17:50 UTC
Last seen:	2024-04-29 05:35:26 UTC
File type:	zip
MIME type:	application/zip
ssdeep	3072:6J1mfyam5pu+iKHGdeuHOJVTJd67vuehhl:6JiBU5imueuuJ7dqv9hhl
TLSH	T1BFA3127F7D437C3CD714827AE55C96C196F2C2244642847DA1B8942EEFA79AC7238E0E
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	BlackMatter Ransomware.BlackMatter zip

cocaman

Malicious email (T1566.001)
From: "Jenny Green <Jenny@gsd.com>" (likely spoofed)
Received: "from [202.3.76.39] (unknown [202.3.76.42]) "
Date: "Sat, 27 Apr 2024 08:52:30 +0430"
Subject: "Your Document"
Attachment: "Document.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

314

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Document.doc.scr
File size:	199'168 bytes
SHA256 hash:	41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898
MD5 hash:	6fd558cf3add096970e15d1e62ca1957
MIME type:	application/x-dosexec
Signature	Ransomware.BlackMatter

Vendor Threat Intelligence

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade packed zeroaccess

Link:

https://www.filescan.io/uploads/662b471b75339da04fa082c2/reports/8d16fcda-e786-4372-866e-2b45ea30ac31/overview

Verdict:

Malicious

Labled as:

HIDDENEXT/Worm.Generic

Link:

https://www.hybrid-analysis.com/sample/d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

lockbit

Score:

10/10

Tags:

family:lockbit ransomware spyware stealer

Link:

https://tria.ge/reports/240426-hn8c8sbc26/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

Modifies Control Panel

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Enumerates physical storage devices

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops desktop.ini file(s)

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Renames multiple (355) files with added filename extension

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CRIME_WIN32_RANSOM_BLACKMATTER Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects Blackmatter ransomware

Rule name:	Darkside Create hunting rule
Author:	@bartblaze
Description:	Identifies Darkside ransomware.

Rule name:	lb_stack_string_decrypt_0001 Create hunting rule
Author:	CTI Purple Team
Description:	This rule detects the code pattern of the Stack Strings decryption algorithm.

Rule name:	lb_stack_string_decrypt_1 Create hunting rule
Author:	CTI Purple Team
Description:	This rule detects the code pattern of the Stack Strings decryption algorithm.

Rule name:	lb_stack_string_decrypt_100 Create hunting rule
Author:	CTI Purple Team
Description:	This rule detects the code pattern of the Stack Strings decryption algorithm.