win.blackmatter (Back to overview)



According to PCrisk, BlackMatter is a piece of malicious software categorized as ransomware. It operates by encrypting data for the purpose of making ransom demands for the decryption tools. In other words, files affected by BlackMatter are rendered inaccessible, and victims are asked to pay - to recover access to their data.

During the encryption process, files are appended with an extension consisting of a random character string. For example, a file initially named "1.jpg" would appear as something similar to "1.jpg.k5RO9fVOl". After this process is complete, the ransomware changes the desktop wallpaper and created a ransom note - "[random_string].README.txt" (e.g., k5RO9fVOl.README.txt).

2022-09-22BroadcomSymantec Threat Hunter Team
Noberus Ransomware: Darkside and BlackMatter Successor Continues to Evolve its Tactics
BlackCat BlackMatter DarkSide
2022-08-02Recorded FutureInsikt Group
Initial Access Brokers Are Key to Rise in Ransomware Attacks
Azorult BlackMatter Conti Mars Stealer Raccoon RedLine Stealer Taurus Stealer Vidar
2022-07-25Trend MicroByron Gelera, Ieriz Nicolle Gonzalez, Ivan Nicole Chavez, Katherine Casona, Nathaniel Gregory Ragasa, Nathaniel Morales
LockBit Ransomware Group Augments Its Latest Variant, LockBit 3.0, With BlackMatter Capabilities
BlackMatter LockBit
Lockbit 3.0
BlackMatter DarkSide LockBit
2022-05-09Microsoft SecurityMicrosoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
Griffon BazarBackdoor BlackCat BlackMatter Blister Gozi LockBit Pandora Rook SystemBC TrickBot
2022-05-09MicrosoftMicrosoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
AnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon ATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands Gozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix Locker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT
Bateleur BELLHOP Griffon SQLRat POWERSOURCE Andromeda BABYMETAL BlackCat BlackMatter BOOSTWRITE Carbanak Cobalt Strike DNSMessenger Dridex DRIFTPIN Gameover P2P MimiKatz Murofet Qadars Ranbyus SocksBot
2022-04-13MicrosoftMicrosoft 365 Defender Threat Intelligence Team
Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware
BlackMatter Cobalt Strike DarkSide Ryuk Zloader
2022-04-08The Hacker NewsRavie Lakshmanan
Researchers Connect BlackCat Ransomware with Past BlackMatter Malware Activity
BlackCat BlackMatter BlackCat BlackMatter
2022-03-24SentinelOneAntonio Cocomazzi
Ransomware Encryption Internals: A Behavioral Characterization
Babuk Babuk BlackMatter
2022-03-23splunkShannon Davis
Gone in 52 Seconds…and 42 Minutes: A Comparative Analysis of Ransomware Encryption Speed
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-03-22The RegisterJeff Burt
This is a BlackCat you don't want crossing your path
BlackCat BlackMatter
2022-03-17CiscoCaitlin Huey, Tiago Pereira
From BlackMatter to BlackCat: Analyzing two attacks from one affiliate
BlackCat BlackMatter BlackCat BlackMatter
2022-03-17SophosTilly Travers
The Ransomware Threat Intelligence Center
ATOMSILO Avaddon AvosLocker BlackKingdom Ransomware BlackMatter Conti Cring DarkSide dearcry Dharma Egregor Entropy Epsilon Red Gandcrab Karma LockBit LockFile Mailto Maze Nefilim RagnarLocker Ragnarok REvil RobinHood Ryuk SamSam Snatch WannaCryptor WastedLocker
2022-03-16SymantecSymantec Threat Hunter Team
The Ransomware Threat Landscape: What to Expect in 2022
AvosLocker BlackCat BlackMatter Conti DarkSide DoppelPaymer Emotet Hive Karma Mespinoza Nemty Squirrelwaffle VegaLocker WastedLocker Yanluowang Zeppelin
VirusTotal's 2021 Malware Trends Report
Anubis AsyncRAT BlackMatter Cobalt Strike DanaBot Dridex Khonsari MimiKatz Mirai Nanocore RAT Orcus RAT
2022-02-23splunkShannon Davis, SURGe
An Empirically Comparative Analysis of Ransomware Binaries
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-01-19BlackberryThe BlackBerry Research & Intelligence Team
Kraken the Code on Prometheus
Prometheus Backdoor BlackMatter Cerber Cobalt Strike DCRat Ficker Stealer QakBot REvil Ryuk
2022-01-19MandiantAdrian Sanchez Hernandez, Ervin James Ocampo, Paul Tarter
One Source to Rule Them All: Chasing AVADDON Ransomware
BlackMatter Avaddon BlackMatter MedusaLocker SystemBC ThunderX
2021-12-10Medium s2wlabS2W TALON
BlackCat: New Rust based ransomware borrowing BlackMatter’s configuration
BlackCat BlackMatter
2021-11-24GoogleGoogle Cybersecurity Action Team, Google Threat Analysis Group
Threat Horizons Cloud Threat Intelligence November 2021. Issue 1
2021-11-04CrowdStrikeEric Loui, Josh Reynolds
CARBON SPIDER Embraces Big Game Hunting, Part 2
BlackMatter Griffon BlackMatter DarkSide HiddenTear JSSLoader
2021-11-03Group-IBAndrey Zhdanov
The Darker Things BlackMatter and their victims
BlackMatter DarkSide BlackMatter DarkSide
2021-11-03Bleeping ComputerLawrence Abrams
BlackMatter ransomware moves victims to LockBit after shutdown
BlackMatter BlackMatter LockBit
2021-11-03The RecordCatalin Cimpanu
BlackMatter ransomware says its shutting down due to pressure from local authorities
2021-11-02VaronisDvir Sason
BlackMatter Ransomware: In-Depth Analysis & Recommendations
2021-10-22EllipticElliptic Intel
DarkSide bitcoins on the move following government cyberattack against REvil ransomware group
BlackMatter DarkSide BlackMatter DarkSide
2021-10-22The RecordCatalin Cimpanu
DarkSide ransomware gang moves some of its Bitcoin after REvil got hit by law enforcement
BlackMatter DarkSide BlackMatter DarkSide
2021-10-22Bleeping ComputerIonut Ilascu
DarkSide ransomware rushes to cash out $7 million in Bitcoin
BlackMatter DarkSide BlackMatter DarkSide
2021-10-22Twitter (@GelosSnake)Omri Segev Moyal
Tweet on List of wallets used by Darkside/Blackmatter Operator to split out the money
BlackMatter DarkSide BlackMatter DarkSide
2021-10-20MandiantJacob Thompson
Hidden in Plain Sight: Identifying Cryptography in BLACKMATTER Ransomware
Alert (AA21-291A): BlackMatter Ransomware
BlackMatter BlackMatter
2021-10-14YouTube (Uriel Kosayev)Uriel Kosayev
DarkSide Ransomware Reverse Engineering
BlackMatter DarkSide BlackMatter DarkSide
2021-10-12CrowdStrikeCrowdStrike Intelligence Team
ECX: Big Game Hunting on the Rise Following a Notable Reduction in Activity
Babuk BlackMatter DarkSide REvil Avaddon Babuk BlackMatter DarkSide LockBit Mailto REvil
2021-09-23BlackberryThe BlackBerry Research & Intelligence Team
Threat Thursday: BlackMatter RaaS - Darker Than DarkSide?
BlackMatter DarkSide BlackMatter DarkSide
2021-09-22McAfeeAlexandre Mundo, Marc Elias
BlackMatter Ransomware Analysis; The Dark Side Returns
2021-09-21Nozomi NetworksNozomi Networks Labs
BlackMatter Ransomware Technical Analysis and Tools from Nozomi Networks Labs
2021-09-14CrowdStrikeCrowdStrike Intelligence Team
Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack
BlackMatter DarkSide REvil Avaddon BlackMatter Clop Conti CryptoLocker DarkSide DoppelPaymer Hades REvil
2021-09-10S2W LAB Inc.S2W TALON
Groove x RAMP : The relation between Groove, Babuk, Payload.bin, RAMP, and BlackMatter
Babuk BlackMatter Babuk BlackMatter
2021-09-08McAfeeJohn Fokker, Max Kersten, Thibault Seret
How Groove Gang is Shaking up the Ransomware-as-a-Service Market to Empower Affiliates
Babuk BlackMatter Babuk BlackMatter CTB Locker
2021-09-08Medium s2wlabS2W TALON
Groove’s thoughts on Blackmatter, Babuk, and cheese shortages in the Netherlands
Babuk BlackMatter Babuk BlackMatter
2021-09-08Ciper Tech SolutionsCipher Tech ACCE Team
Rapidly Evolving BlackMatter Ransomware Tactics
2021-09-06KELAVictoria Kivilevich
The Ideal Ransomware Victim: What Attackers Are Looking For
BlackMatter Cryakl
2021-09-05Chuongdong blogChuong Dong
BlackMatter Ransomware v2.0
2021-09-02US Department of Health and Human ServicesHealth Sector Cybersecurity Coordination Center (HC3)
Demystifying BlackMatter
BlackMatter BlackMatter DarkSide
2021-09-01Medium s2wlabChaewon Moon, Denise Dasom Kim, Jungyeon Lim, S2W LAB INTELLIGENCE TEAM, Sujin Lim, Yeonghyeon Jeong
BlackMatter x Babuk : Using the same web server for sharing leaked files
Babuk BlackMatter Babuk BlackMatter
2021-08-31Minerva LabsMinerva Labs
BlackMatter - The New Star Of Ransomware
2021-08-23NetskopeGustavo Palazolo
Netskope Threat Coverage: BlackMatter
2021-08-15SymantecThreat Hunter Team
The Ransomware Threat
Babuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike Conti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex MimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker
2021-08-09SophosMark Loman
BlackMatter ransomware emerges from the shadow of DarkSide
BlackMatter BlackMatter
2021-08-06Group-IBAndrey Zhdanov
It's alive! The story behind the BlackMatter ransomware strain
BlackMatter DarkSide BlackMatter DarkSide
2021-08-05TesorionGijs Rijnders
Analysis of the BlackMatter ransomware
2021-08-04Jan Gruber
Understanding BlackMatter's API Hashing
2021-08-04Recorded FutureInsikt Group®
Protect Against BlackMatter Ransomware Before It’s Offered
BlackMatter DarkSide
Yara Rules
[TLP:WHITE] win_blackmatter_auto (20230808 | Detects win.blackmatter.)
rule win_blackmatter_auto {

        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.blackmatter."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = ""
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.

        $sequence_0 = { 57 c745fc00000000 ff35???????? e8???????? 8bf8 }
            // n = 5, score = 400
            //   57                   | push                edi
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   ff35????????         |                     
            //   e8????????           |                     
            //   8bf8                 | mov                 edi, eax

        $sequence_1 = { ff75f8 ff15???????? 85c0 0f85e7000000 68???????? }
            // n = 5, score = 400
            //   ff75f8               | push                dword ptr [ebp - 8]
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   0f85e7000000         | jne                 0xed
            //   68????????           |                     

        $sequence_2 = { 83c4d8 53 56 57 c745fc00000000 c745f800000000 }
            // n = 6, score = 400
            //   83c4d8               | add                 esp, -0x28
            //   53                   | push                ebx
            //   56                   | push                esi
            //   57                   | push                edi
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   c745f800000000       | mov                 dword ptr [ebp - 8], 0

        $sequence_3 = { e8???????? 8945fc eb0c 83c702 ff4df8 837df800 }
            // n = 6, score = 400
            //   e8????????           |                     
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   eb0c                 | jmp                 0xe
            //   83c702               | add                 edi, 2
            //   ff4df8               | dec                 dword ptr [ebp - 8]
            //   837df800             | cmp                 dword ptr [ebp - 8], 0

        $sequence_4 = { e9???????? ff75c8 e8???????? 8945c4 }
            // n = 4, score = 400
            //   e9????????           |                     
            //   ff75c8               | push                dword ptr [ebp - 0x38]
            //   e8????????           |                     
            //   8945c4               | mov                 dword ptr [ebp - 0x3c], eax

        $sequence_5 = { ff15???????? 83c40c 8d047500000000 50 8d45da }
            // n = 5, score = 400
            //   ff15????????         |                     
            //   83c40c               | add                 esp, 0xc
            //   8d047500000000       | lea                 eax, [esi*2]
            //   50                   | push                eax
            //   8d45da               | lea                 eax, [ebp - 0x26]

        $sequence_6 = { 85f6 0f842c010000 56 ff35???????? e8???????? ff35???????? e8???????? }
            // n = 7, score = 400
            //   85f6                 | test                esi, esi
            //   0f842c010000         | je                  0x132
            //   56                   | push                esi
            //   ff35????????         |                     
            //   e8????????           |                     
            //   ff35????????         |                     
            //   e8????????           |                     

        $sequence_7 = { f7f1 92 3b4508 720b 3b450c }
            // n = 5, score = 400
            //   f7f1                 | div                 ecx
            //   92                   | xchg                eax, edx
            //   3b4508               | cmp                 eax, dword ptr [ebp + 8]
            //   720b                 | jb                  0xd
            //   3b450c               | cmp                 eax, dword ptr [ebp + 0xc]

        $sequence_8 = { 8945ec e8???????? e8???????? 803d????????00 7405 }
            // n = 5, score = 400
            //   8945ec               | mov                 dword ptr [ebp - 0x14], eax
            //   e8????????           |                     
            //   e8????????           |                     
            //   803d????????00       |                     
            //   7405                 | je                  7

        $sequence_9 = { ff75f4 e8???????? 5e 5b 8be5 5d c3 }
            // n = 7, score = 400
            //   ff75f4               | push                dword ptr [ebp - 0xc]
            //   e8????????           |                     
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c3                   | ret                 

        7 of them and filesize < 194560
Download all Yara Rules