Groove x RAMP : The relation between Groove, Babuk, Payload.bin,
RAMP, and BlackMatter
By S2W
Published: 2021-09-10 · Archived: 2026-04-05 18:01:45 UTC
Hotsauce | S2W TALON
The relation graph of Groove, Babuk, Payload.bin, RAMP, and BlackMatter
Groove mentioned several cryptocurrency wallet addresses such as BTC, XMR and ETH. Those addresses are same
as RAMP’s addresses mentioned on their leak site.
Groove used the file server same as BlackMatter and Babuk [2].
The operator of RAMP was linked to the operator of Babuk and Payload.bin [3].
Press enter or click to view image in full size
Analyzed by Xarvis
Groove’s BTC, XMR and ETH == RAMP
BTC: 1EZhsp26j4ZfDfKyXpweUtGgrs3fnpPCEd
ETH: 0xF6a4906fA254ce0e9175E2C3418Dde999b99ed1F
XMR:
47GyLQAPw4Ee3WVTgCtSxwNcRinsEm3jdSX8FH4DLbjb5t79CJDxrK9gMNVJNDfCLEjhdJZyWCPBG5CkiTnGqMvnPgK
Press enter or click to view image in full size
https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d
Page 1 of 2

Comparison of cryptocurrency addresses between Groove and RAMP
Homepage: https://www.s2wlab.com
Facebook: https://www.facebook.com/S2WLAB/
Twitter: https://twitter.com/s2wlab
Source: https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d
https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d
Page 2 of 2