BlackMatter Ransomware — MB Conti Etiketi Yanlis, mojobiden.com + paymenthacks.com C2, TOR Odeme | Kritik

Manuel Statik Analiz (LLM Okumali) — BlackMatter Ransomware | Tehdit: KRITIK

MalwareBazaar Conti etiketledi ancak cleartext ransom notu "BlackMatter Ransomware" yazmaktadir. Yanlis etiket tespiti.

Datei Kimligi

SHA256	`b70e78971fc44f8413447139afe777f19fd1b93cf3b4843ef6da7c534f1e9b0a`
Datei Adi	run-as-admin.exe
Größe	515.584 byte
MB Etiketi	Conti (YANLIS)
Gercek Familie	BlackMatter

Cleartext C2 Adresleri

Tip	Adres	Amac
HTTP/HTTPS	`http://mojobiden.com` `https://mojobiden.com`	Data exfiltrasyon / C2
HTTP/HTTPS	`http://paymenthacks.com` `https://paymenthacks.com`	Fidye odeme portalı
TOR Onion	`supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion`	TOR uzerinden destek portali

Cleartext Ransom Notu

BlackMatter Ransomware encrypted all your files!
   Your network is encrypted, and currently not operational.
   We need only money, after payment we will give you a
   decryptor for the entire network and you will restore
   all the data.

[Note file]: oG5IasxF4.README.txt

Anti-AV ve Anti-Forensics

net stop wuauserv      -- Windows Update durdurma
sophos                 -- Sophos AV tespiti

Mutex

__MUTEX_NAME__ — Placeholder mutex; ayni makineye tekrar enfeksiyonu onler

BlackMatter Hakkinda

BlackMatter, DarkSide geliştiricilerince 2021 yilinda baslatilmistir (DarkSide, Colonial Pipeline saldirisindan sonra kapanmistir). Kurumsal aglarini hedefler, "double extortion" (sifreleme + veri sizintisi tehdidi) kullanir. Kurasal sanayi, gida ve enerji sektorunu etkilemistir. Kasim 2021'de yeniden kapanmistir.

IOC

SHA256	`b70e78971fc44f8413447139afe777f19fd1b93cf3b4843ef6da7c534f1e9b0a`
C2	mojobiden.com, paymenthacks.com
TOR	supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion
Ransom Notu	oG5IasxF4.README.txt

BlackMatter — Malware-Profil

BlackMatter RaaS 2021. DarkSide devami. Cobalt Strike+run-as-admin. ABD kritik altyapi.

Malware-Typ

Ransomware

Programmiersprache

C2-Protokoll

—

Zielsysteme

Windows/Linux

Fähigkeiten & Verhalten

Dosya Şifreleme (AES/RSA)

Gölge Kopya Silme

Yedek Kaldırma

Fidye Notu Oluşturma

Kalıcılık Sağlama

Ağ Paylaşımı Şifreleme

Anti-Analiz Teknikleri

Çift Gasp (Data Leak)

IOC-Liste (1 Indikatoren)

IOC — BlackMatter

# SHA256
b70e78971fc44f8413447139afe777f19fd1b93cf3b4843ef6da7c534f1e9b0a

Typ	Wert	Bemerkung
sha256	b70e78971fc44f8413447139afe777f19fd1b93cf3b4843ef6da7c534f1e9b0a

BlackMatter — Zum vollständigen Profil →

C2-Server (6 erfasste Server für diese Familie)

Adresse	Typ	Port	Protokoll	Status	Land
mojobiden.com	domain	—	—	active	—
mojobiden.com	domain	443	HTTPS	active	—
mojobiden.com	domain	443	HTTPS	active	—
paymenthacks.com	domain	443	HTTPS	inactive	—
supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion	domain	80	HTTPS	inactive	—
paymenthacks.com	domain	443	HTTPS	inactive	—

C2-Adressen stammen ausschließlich aus vom KEYDAL-Team manuell verifizierten Malware-Samples. Kommerzielle Nutzung ist untersagt.