MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BlackMatter

Vendor detections: 17

Intelligence 17 IOCs YARA 6 File information Comments

SHA256 hash:	e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a
SHA3-384 hash:	09cd2c7fcb778fa19896b19049364452589ad34d638303823eb1c57afa81c8f11e596db4aea6851db7f04c9038b89aa0
SHA1 hash:	8e21140a20bb5470f36cc1a3a533584eab3da187
MD5 hash:	5bf0cb2ef6940d7453bc77775be3dc1f
humanhash:	king-maine-avocado-beryllium
File name:	file
Download:	download sample
Signature	BlackMatter Create hunting rule
File size:	149'504 bytes
First seen:	2026-06-10 13:09:08 UTC
Last seen:	2026-06-17 10:31:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	41fb8cb2943df6de998b35a9d28668e8 (156 x BlackMatter, 9 x LockBit, 1 x DragonForce)
ssdeep	3072:U6glyuxE4GsUPnliByocWepCyISCIb1p0Oq:U6gDBGpvEByocWepDIOq
Threatray	2'523 similar samples on MalwareBazaar
TLSH	T130E36D21F212D0B3C83718F13736B5B2F39E8E6C19996807EAD80F59BC658236F45997
TrID	20.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 19.8% (.EXE) Win64 Executable (generic) (6522/11/2) 15.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4504/4/1) 6.3% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
Reporter	Bitsight
Tags:	BlackMatter dropped-by-phorpiex exe

Bitsight

url: http://178.16.54.109/lb19.exe

Intelligence

File Origin

# of uploads :

183

# of downloads :

152

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

LockBit

Details

Link:

https://research.acce.ciphertechsolutions.com/results/93872602-3ea7-449f-8690-dbd46402b780/

Malware family:

n/a

ID:

File name:

_e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a.exe

Verdict:

No threats detected

Analysis date:

2026-06-10 13:12:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/a93d268d-09ea-437a-b64d-b4cf1178a1cc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/70513/

Detection(s):

Win.Ransomware.LockBitBlack-10033143-1

Win.Ransomware.BlackMatter-9965914-0

Win.Ransomware.Lazy-10003135-0

YARA.CRAIU_Crime_Lockbit3_Ransomware.UNOFFICIAL

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a296237a15110463ee47d64

Tags:

infosteal spawn

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Connection attempt

Сreating synchronization primitives

Launching a service

Changing a file

Reading critical registry keys

Creating a file in the %AppData% directory

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Modifies multiple files

Using the Windows Management Instrumentation requests

Creating a file in the %temp% directory

Moving a file to the %temp% directory

Deleting a system file

Creating a window

Searching for the window

Stealing user critical data

Creating a file in the mass storage device

Forced shutdown of a system process

Forced shutdown of a browser

Encrypting user's files

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a29621dbf16337e43bfe5d5/reports/7c75334d-8186-4091-91aa-b3ad1b6b324e/overview

Verdict:

Malicious

Labled as:

Ransom.BlackMatter.Generic

Link:

https://www.hybrid-analysis.com/sample/e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-06-10T10:17:00Z UTC

Last seen:

2026-06-10T12:08:00Z UTC

Hits:

~10

Detections:

Trojan-Ransom.Win32.BlackMatter.d Trojan.Win32.Zapchast.bgvs Trojan.Win32.Inject.sb Trojan.Win32.Agent.sb Trojan-Ransom.Win32.Encoder.sb Trojan-Dropper.Win32.Dycler Trojan-Dropper.Win32.Dapato.sb PDM:Trojan.Win32.Generic Trojan-Ransom.Win32.Lockbit.tre Trojan-Ransom.Win32.Agent.sb HEUR:Trojan-Ransom.Win32.Generic

Link:

https://opentip.kaspersky.com/e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a/results?tab=lookup

Malware family:

BlackMatter Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/644ee63e-8d78-4aed-9ef6-fb8ab21b8ef5

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a

Gathering data

Detection:

lockbit

Link:

https://mwdb.cert.pl/sample/e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a/

Verdict:

Malicious

Threat:

Family.LOCKBIT

Link:

https://tip.neiki.dev/file/e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a

Threat name:

Win32.Ransomware.Lockbit

Status:

Malicious

First seen:

2026-06-10 13:10:55 UTC

File Type:

PE (Exe)

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=46i76tjio6nxfp3xecytxw4rvg7gpdclt5ndjycnmpl2jnxto55a._file

Verdict:

malicious

Label(s):

lockbit

BlackMatter

068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd

BlackMatter

2d78ccb074929ea9134063306229d29fbd5416b8d2e720e4e91b92822ed49bbd

BlackMatter

3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1

BlackMatter

e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a

BlackMatter

error

BlackMatter

+ 2'513 additional samples on MalwareBazaar

Result

Malware family:

lockbit

Score:

10/10

Tags:

family:lockbit defense_evasion discovery ransomware spyware stealer

Link:

https://tria.ge/reports/260610-qeadvacw3n/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Control Panel

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops desktop.ini file(s)

Enumerates connected drives

Indicator Removal: File Deletion

Checks computer location settings

Deletes itself

Executes dropped EXE

Reads user/profile data of web browsers

Renames multiple (1072) files with added filename extension

Unpacked files

SH256 hash:

e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a

MD5 hash:

5bf0cb2ef6940d7453bc77775be3dc1f

SHA1 hash:

8e21140a20bb5470f36cc1a3a533584eab3da187

Detections:

triage_blackmatter_ransomware

triage_lockbit3_ransomware

triage_lockbit_ransomware

Link:

https://www.unpac.me/results/ae9d32cb-b93e-4357-af87-99b74cda01d3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.82

Link:

https://yomi.yoroi.company/submissions/e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CRIME_WIN32_RANSOM_BLACKMATTER Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects Blackmatter ransomware

Rule name:	Darkside Create hunting rule
Author:	@bartblaze
Description:	Identifies Darkside ransomware.

Rule name:	Detect_all_IPv6_variants Create hunting rule
Author:	Bierchermuesli
Description:	Generic IPv6 catcher

Rule name:	lb_stack_string_decrypt_1 Create hunting rule
Author:	CTI Purple Team
Description:	This rule detects the code pattern of the Stack Strings decryption algorithm.

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.