paymenthacks.com

nowautomation.com

ransomware.blackmatter.windows

072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486

2c323453e959257c7aa86dc180bb3aaaa5c5ec06fa4e72b632d9e4b817052009

4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91

668a4a2300f36c9df0f7307cc614be3297f036fa312a424765cdb2c169187fe6

7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984

c728e3a0d4a293e44314d663945354427848c220d05d5d87cdedd9995fee3dfe

84af3f15701d259f3729d83beb15ca738028432c261353d1f9242469d791714f

7c642cdeaa55f56c563d82837f4dc630583b516a5d02d5a94b57b65489d74425

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db

b824bbc645f15e213b4cb2628f7d383e9e37282059b03f6fe60f7c84ea1fed1f

2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c

1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849

20742987e6f743814b25e214f8b2cd43111e2f60a8856a6cca87cafd85422f41

2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2

4be85e2083b64838fb66b92195a250228a721cdb5ae91817ea97b37aa53f4a2b

5da8d2e1b36be0d661d276ea6523760dbe3fa4f3fdb7e32b144812ce50c483fa

706f3eec328e91ff7f66c8f0a2fb9b556325c153a329a2062dc85879c540839d

8f1b0affffb2f2f58b477515d1ce54f4daa40a761d828041603d5536c2d53539

b0e929e35c47a60f65e4420389cad46190c26e8cfaabe922efd73747b682776a

cb5a89a31a97f8d815776ff43f22f4fec00b32aae4f580080c7300875d991163

e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4

eafce6e79a087b26475260afe43f337e7168056616b3e073832891bf18c299c1

496cd9b6b6b96d6e781ab011d1d02ac3fc3532c8bdd07cae5d43286da6e4838d

4524784688e60313b8fefdebde441ca447c1330d90b86885fb55d099071c6ec9

69e5f8287029bcc65354abefabb6854b4f7183735bd50b2da0624eb3ae252ea8

8eada5114fbbc73b7d648b38623fc206367c94c0e76cb3b395a33ea8859d2952

ed47e6ecca056bba20f2b299b9df1022caf2f3e7af1f526c1fe3b8bf2d6e7404

26a7146fbed74a17e9f2f18145063de07cc103ce53c75c8d79bbc5560235c345

9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58

9a8cd3a30e54a2ebb6d73fd7792ba60a6278a7301232321f226bb29fb8d0b3d6

6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502

https://twitter.com/ddd1ms/status/1441044423798820889

http://paymenthacks.com

http://mojobiden.com

http://nowautomation.com

http://fluentzip.org

import "elf"

rule DarkSide_BM {
	meta:
		author = "Andrey Zhdanov"
		company = "Group-IB"
		family = "ransomware.darkside_blackmatter"
		description = "DarkSide/BlackMatter ransomware Windows payload"
		severity = 10
		score = 100
	strings:
		$h1 = { 64 A1 30 00 00 00 8B B0 A4 00 00 00 8B B8 A8 00 00 00 83 FE 05 75 05 83 FF 01 }
	condition:
		((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and ((1 of ($h*)))
}

import "elf"

rule BlackMatter_Linux {
	meta:
		author = "Andrey Zhdanov"
		company = "Group-IB"
		family = "ransomware.blackmatter.linux"
		description = "BlackMatter ransomware Linux payload"
		severity = 10
		score = 100
	strings:
		$h0 = { 0F B6 10 84 D2 74 19 0F B6 34 0F 40 38 F2 74 10 48 83 C1 01 31 F2 48 83 F9 20 88 10 49 0F 44 C9 48 83 C0 01 4C 39 C0 75 D7 }
		$h1 = { 44 42 46 44 C7 4? [1-2] 30 35 35 43 C7 4? [1-2] 2D 39 43 46 C7 4? [1-2] 32 2D 34 42 C7 4? [1-2] 42 38 2D 39 C7 4? [1-2] 30 38 45 2D C7 4? [1-2] 36 44 41 32 C7 4? [1-2] 32 33 32 31 C7 4? [1-2] 42 46 31 37 }
	condition:
		(uint32(0) == 0x464C457F) and ((1 of ($h*)) or for any i in (0 .. elf.number_of_sections - 2) : ( (elf.sections[i].name == ".app.version") and (elf.sections[i + 1].name == ".cfgETD") ))
}