{
	"id": "c4da8e9b-2189-4438-9b75-152e27c08f72",
	"created_at": "2026-04-06T00:08:46.543404Z",
	"updated_at": "2026-04-10T13:11:40.890238Z",
	"deleted_at": null,
	"sha1_hash": "476575b58f12d767e4041013773b360c1fb0b31d",
	"title": "Netskope Threat Coverage: BlackMatter",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 255179,
	"plain_text": "Netskope Threat Coverage: BlackMatter\r\nBy Gustavo Palazolo\r\nPublished: 2021-08-23 · Archived: 2026-04-05 16:20:48 UTC\r\nSummary\r\nIn July of 2021, a new ransomware named BlackMatter emerged and was being advertised in web forums where\r\nthe group was searching for compromised networks from companies with revenues of $100 million or more per\r\nyear. Although they are not advertising as a Ransomware-as-a-Service (RaaS), the fact they are looking for\r\n“partners” is an indication that they are operating in this model. Furthermore, the group is claiming to have\r\ncombined features from larger groups, such as DarkSide and REvil (a.k.a. Sodinokibi).\r\nBlackMatter advertisement in a web forum. (Source: The Record)\r\nAccording to an interview with an alleged representative from BlackMatter, they have incorporated the ideas of\r\nLockBit, REvil, and DarkSide, after studying their ransomware in detail. Also, the BlackMatter representative\r\nbelieves that other ransomware groups have disappeared from the scene due to attention from governments\r\nfollowing high-profile attacks.  BlackMatter plans to avoid such attention by being careful not to infect any\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 1 of 28\n\ncritical infrastructure. This is echoed on their website, which states they are not willing to attack hospitals, critical\r\ninfrastructures, defense industry, and non-profit companies.\r\nMain page of BlackMatter’s website, hosted on the deep web.\r\nThe oil and gas industry is also excluded from the target list, a reference to the Colonial Pipeline attack where\r\nDarkSide stopped the fuel delivery across the Southeastern of the United States, followed by the shut down of the\r\nransomware operation due to the pressure from law enforcement. The BlackMatter spokesperson also said that the\r\nColonial PIpeline attack was a key factor for the shutdown of REvil and DarkSide, and that’s why they are\r\nexcluding this kind of sector from the target list.\r\nBlackMatter already claims to have hit three victims, each listed on their deep web site, which follows the same\r\nstandard from other groups, containing the name of the attacked company, a summary of what data they have\r\nstolen, and the deadline for the ransom before the data is published.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 2 of 28\n\nOne of the DarkSide targets, with leaked data on the website.\r\nOne of the companies infected by BlackMatter is SolarBR, which is the second-largest manufacturer of Coca-Cola\r\nin Brazil, where the group claimed to have stolen 50 GB of confidential finance, logistics, development, and other\r\ndata.\r\nSolar Coca-Cola infected by BlackMatter\r\nAccording to the post, if the ransom isn’t paid, the group will publish the data and inform all of the “biggest mass-media in Brazil and US,” making “Coca Cola and her lovers” to be “madly angry”.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 3 of 28\n\nInformation from BlackMatter’s deep web site.\r\nThere is no official information about the ransom amount BlackMatter is requesting from Solar Coca-Cola, but the\r\ndeadline is set to August 23, 2021.\r\nIn this threat coverage report, we will analyze a Windows BlackMatter sample, version 1.2, describing some of the\r\nkey features of the malware. \r\nThreat\r\nLike other malware, BlackMatter implements many techniques to avoid detection and make reverse engineering\r\nmore challenging. The first item we would like to cover is how BlackMatter dynamically resolves API calls to\r\nhide them from the PE import table.\r\nThis is done by a multi-step process. First, the malware creates a unique hash that will identify both the DLL and\r\nAPI name that needs to be executed. To make this a bit harder for static detections, the real hash value is encrypted\r\nwith a simple XOR operation. In this case, the key is 0x22065FED.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 4 of 28\n\nFigure 1. Function that loads the import based on a hash.\r\nIn the example above, after the XOR operation, the value 0x27D05EB2 is passed as a parameter to the function\r\nresponsible for searching and loading the API. The code first enumerates all the DLLs that are loaded within the\r\nprocess through a common but interesting technique. \r\nFirst, it loads the Process Environment Block (PEB) address, which is located in the Thread Environment Block\r\n(TEB). Then, it loads the doubly linked list that contains all the loaded modules for the process, located in the\r\nPEB_LDR_DATA structure.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 5 of 28\n\nFigure 2. BlackMatter function searching loaded modules using the PEB.\r\nOnce the loaded DLL is located, the function retrieves the DLL’s offset, finds the PE header address, and then\r\ncalculates the offset of the PE export directory, so it can enumerate the APIs exported by the DLL.\r\nIf the export table is found, the ransomware then calculates the hash value for both DLL and API name, using the\r\nfollowing function:\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 6 of 28\n\nFigure 3. Function used by BlackMatter to calculate the hash of the string.\r\nTo get the unique hash, the ransomware first calculates the hash only for the DLL name.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 7 of 28\n\nFigure 4. Hash generation for the DLL “kernel32.dll”\r\nIn the example above, the hash for the DLL “ kernel32.dll ” is 0xB1FC7F66, which is then used by this same\r\nfunction to calculate the hash of the API name.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 8 of 28\n\nFigure 5. Generating the final hash for DLL + API name\r\nTherefore, using the same function again, the malware has generated the hash 0x27D05EB2 for the DLL\r\n“ kernel32.dll ” and the API “ LoadLibraryA ”, which is exactly the same value the malware is seeking, as\r\ndemonstrated in Figure 1.\r\nIf the hash generated by the function matches the hash the malware passed as a parameter, the offset for the API is\r\nstored in memory, so the function can be called.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 9 of 28\n\nFigure 6. BlackMatter’s code before and after the APIs were dynamically resolved.\r\nSeveral DLLs are loaded by BlackMatter dynamically after the executable is running, as we can see below.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 10 of 28\n\nFigure 7. DLLs dynamically loaded by BlackMatter.\r\nTo make the analysis faster, we’ve created a script that implements the same logic used by BlackMatter for the\r\nhash generation. Therefore, the script can be used to locate calls to specific APIs across BlackMatter’s code.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 11 of 28\n\nFigure 8. Script to generate the hash based on the API call.\r\nAnother technique used by BlackMatter to stay under the radar is to encrypt all its important strings. In the\r\nsamples we’ve analyzed, the ransomware used the same key as the one used to generate the hashes for the API\r\nloading process.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 12 of 28\n\nFigure 9. BlackMatter’s routine for string decryption.\r\nAfter the bytes are organized in memory, the code decrypts the data in 4-byte blocks, using a simple XOR\r\noperation with the key 0x22065FED.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 13 of 28\n\nFigure 10. Example of a string decrypted by BlackMatter.\r\nWe can find useful information across the decrypted strings, such as registry keys, file names, and others. The full\r\nlist of decrypted strings can be found in our GitHub repository.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 14 of 28\n\nFigure 11. Some of BlackMatter’s decrypted strings.\r\nBlackMatter also has an encrypted configuration inside the binary, located in a fake PE resource section.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 15 of 28\n\nFigure 12. BlackMatter’s encrypted configuration.\r\nThe first 4 bytes in the section are the initial decryption key, the following 4 bytes represent the size of the data,\r\nand the rest of the bytes are the encrypted configuration. The data is then decrypted using a rolling XOR\r\nalgorithm.\r\nA new decryption key is generated every 4 bytes, using a dynamic seed and a constant, which is 0x8088405 in all\r\nthe samples we have analyzed so far.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 16 of 28\n\nFigure 13. Stub that generates the decryption key.\r\nThe decrypted configuration is compressed using aPLib, so we need to decompress the bytes to get the\r\ninformation. Once this process is done, we can read the contents of the configuration. At the beginning, we can\r\nfind the attacker’s RSA public key, the AES key used to encrypt C2 communication, as well as a 16-byte value\r\nnamed “ bot_company ”.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 17 of 28\n\nFigure 14. BlackMatter’s decrypted configuration.\r\nAside from that, the configuration also includes several base64 encoded strings that contain sensitive strings used\r\nby the malware, like the C2 server addresses.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 18 of 28\n\nFigure 15. Decoding BlackMatter’s C2 server addresses.\r\nAmong the strings, there is also a list of processes and services that the ransomware attempts to stop \\ terminate.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 19 of 28\n\nFigure 16. Ransomware trying to open the VSS service.\r\nTo speed up the analysis, we have created a script that is able to decrypt the strings and the configuration from\r\nBlackMatter samples.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 20 of 28\n\nFigure 17. Decrypting BlackMatter’s strings.\r\nThe script also decodes all base64 values from the configuration automatically:\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 21 of 28\n\nFigure 18. BlackMatter’s C2 server addresses.\r\nBlackMatter communicates with the C2 server in order to send information to the attackers. It first loads a JSON\r\nstructure in memory, containing all the information that will be sent.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 22 of 28\n\nFigure 19. Information that will be sent to the C2 address.\r\nPrior to the POST request, the information is encrypted using AES-128 ECB, with the key extracted from the\r\nconfiguration, and then encoded with base64.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 23 of 28\n\nFigure 20. BlackMatter sending request to the C2 server.\r\nIt’s possible to decrypt this information by decoding the base64 and decrypting the data using the key from the\r\nconfiguration file.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 24 of 28\n\nFigure 21. Decrypting BlackMatter’s C2 request.\r\nBlackMatter sends two requests, the first one contains details about the infected environment, and the second one\r\ncontains details about the encryption process, such as how many files failed to encrypt, the start and end time, etc.\r\nFinally, once the encryption process is complete, the ransom note is created in the same places where there are\r\nencrypted files.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 25 of 28\n\nFigure 22. BlackMatter’s ransom note.\r\nBlackMatter changes the background image, a common practice among ransomware creators.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 26 of 28\n\nFigure 23. BlackMatter’s custom background\r\nProtection\r\nNetskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat\r\nindicators and payloads. \r\nNetskope Threat Protection\r\nTrojan.GenericKD.46740173\r\nGen:Heur.Mint.Zard.25\r\nNetskope Advanced Threat Protection provides proactive coverage against this threat.\r\nGen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis\r\nGen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox\r\nIOCs\r\nSHA256\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 27 of 28\n\n22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6\r\n2c323453e959257c7aa86dc180bb3aaaa5c5ec06fa4e72b632d9e4b817052009\r\n7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984\r\nc6e2ef30a86baa670590bd21acf5b91822117e0cbe6060060bc5fe0182dace99\r\nA full list of IOCs, a Yara rule, and the scripts used in the analysis are all available in our Git repo.\r\nSource: https://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-blackmatter\r\nPage 28 of 28\n\n https://www.netskope.com/blog/netskope-threat-coverage-blackmatter   \nFigure 3. Function used by BlackMatter to calculate the hash of the string.\nTo get the unique hash, the ransomware first calculates the hash only for the DLL name.\n  Page 7 of 28  \n\n https://www.netskope.com/blog/netskope-threat-coverage-blackmatter  \nFigure 17. Decrypting BlackMatter’s strings. \nThe script also decodes all base64 values from the configuration automatically:\n  Page 21 of 28",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.netskope.com/blog/netskope-threat-coverage-blackmatter"
	],
	"report_names": [
		"netskope-threat-coverage-blackmatter"
	],
	"threat_actors": [],
	"ts_created_at": 1775434126,
	"ts_updated_at": 1775826700,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/476575b58f12d767e4041013773b360c1fb0b31d.pdf",
		"text": "https://archive.orkl.eu/476575b58f12d767e4041013773b360c1fb0b31d.txt",
		"img": "https://archive.orkl.eu/476575b58f12d767e4041013773b360c1fb0b31d.jpg"
	}
}