blackCatConf

github.com/f0wl/blackCatConf

f0wl

go report A+

blackCatConf is a static configuration extractor implemented in Golang for BlackCat Ransomware
(targeting Microsoft Windows and GNU/Linux + VMware ESXi). By default the script will print the
extracted information to stdout. It is also capable of dumping the malware configuration to disk as a
JSON file with the

Info: This tool does currently not support the new version of BlackCat/ALPHV ransomware.

Usage

go run blackcatconf.go [-j] path/to/blackcat_sample.bin

Screenshots

Sensitive victim information in the screenshot below and the example config file has been redacted.

-j  flag.

1/4

Configuration structure

With these novel BlackCat Ransomware samples this config extractor could easily be replaced by a
bash one-liner (e.g.  strings ... | grep "{\"config_id" > config.json
will be config obfuscation/encryption added in future samples of BlackCat, similar to e.g. the changes
made in Darkside Ransomware over time. If this is the case here as well having a structure to
unmarshal the json config into will save me some time down the road.

Speaking of Darkside/BlackMatter: The configuration structure and values of BlackCat share significant
similarities with those found in BlackMatter
published a thorough analysis of the similarities between these two Ransomware strains.

Key

config_id

public_key

extension

note_file_name

. The Korean Threat Intelligence company S2W Lab

Value / Purpose

Configuration ID, empty up until now (= Victim
Identifier?)

RSA Public Key (Base64 encoded)

Extension for encrypted files

Filename of the Ransomnote

), but I expect that there

Type

unknown

string

string

string

2/4

Key

note_full_text

note_short_text

default_file_mode

default_file_cipher

credentials

kill_services

kill_processes

exclude_directory_names

exclude_file_names

exclude_file_extensions

exclude_file_path_wildcard

enable_network_discovery

enable_self_propagation

enable_set_wallpaper

enable_esxi_vm_kill

enable_esxi_vm_snapshot_kill

strict_include_paths

esxi_vm_kill_exclude

Testing

This configuration extractor has been tested successfully with the following samples:

SHA-256

59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f

731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161

5121f08cf8614a65d7a86c2f462c0694c132e2877a7f54ab7fcefd7ee5235a42

Value / Purpose

Long version of the Ransomnote

Short version of the Ransomnote

File Encryption Mode (observed: "auto" and
"Smartpattern")

File Encryption Cipher (observed: "Best")

Array of compromised credentials for escalation and
propagation

List of services to be terminated

List of processes to be terminated

Directories that are excluded from the encryption
process

Files that are excluded from the encryption process

File extensions that are excluded from the encryption
process

Filepaths to be excluded via wildcard

Switch to enable/disable network discovery

Switch to enable/disable self propagation

Switch to enable/disable wallpaper change

Switch to enable/disable VM termination on ESXi Hosts

Switch to enable/disable Snapshot deletion on ESXi
Hosts

Hardcoded filepaths (likely victim-specific)

Exclusion list for virtual machines on ESXi Hosts

OS

Windows

Windows

Linux

Type

string

string

string or
[]int

string

[][]string

[]string

[]string

[]string

[]string

[]string

[]string (?)

bool

bool

bool

bool

bool

[]string (?)

[]string (?)

Sample

Malware
Bazaar

Malware
Bazaar

VX-
Underground

3/4

SHA-256

f8c08d00ff6e8c6adb1a93cd133b19302d0b651afd73ccb54e3b6ac6c60d99c6

If you encounter an error with blackCatConf, please file a bug report via an issue. Contributions are
always welcome :)

OS Sample

Linux VX-
Underground

4/4