Netskopeの SASE Summitにご参加ください 、あなたの近くの都市に来てください!今すぐご登録ください

  • セキュリティサービスエッジ製品

    高度なクラウド対応の脅威から保護し、あらゆるベクトルにわたってデータを保護します。

  • Borderless SD-WAN

    すべてのリモートユーザー、デバイス、サイト、クラウドへの安全で高性能なアクセスを自信を持って提供します。

  • プラットフォーム

    世界最大のセキュリティプライベートクラウドでの比類のない可視性とリアルタイムデータおよび脅威保護。

未来のプラットフォームはネツコペです

インテリジェントセキュリティサービスエッジ(SSE)、クラウドアクセスセキュリティブローカー(CASB)、クラウドファイアウォール、次世代セキュアWebゲートウェイ(SWG)、およびZTNAのプライベートアクセスは、単一のソリューションにネイティブに組み込まれており、セキュアアクセスサービスエッジ(SASE)アーキテクチャへの道のりですべてのビジネスを支援します。

製品概要に移動
Netskopeの動画
ボーダレスSD-WAN:ボーダレスエンタープライズの新時代を先導

NetskopeボーダレスSD-WANは、ゼロトラストの原則と保証されたアプリケーションパフォーマンスを統合するアーキテクチャを提供し、すべてのサイト、クラウド、リモートユーザー、およびIoTデバイスに前例のない安全で高性能な接続を提供します。

Read the article
Borderless SD-WAN
Netskope は、データと脅威の保護、および安全なプライベートアクセスを実現するための機能を統合した、最新のクラウドセキュリティスタックを提供します。

プラットフォームを探索する
大都市の俯瞰図
  • 変身

    デジタルトランスフォーメーションを保護します。

  • セキュリティの近代化

    今日と明日のセキュリティの課題に対応します。

  • フレームワーク

    サイバーセキュリティを形作る規制の枠組みを採用する。

  • 業界ソリューション

    Netskopeは、クラウドに安全に移行するためのプロセスを世界最大規模の企業に提供しています。

最小の遅延と高い信頼性を備えた、市場をリードするクラウドセキュリティサービスに移行します。

NewEdgeの詳細
Lighted highway through mountainside switchbacks
アプリケーションのアクセス制御、リアルタイムのユーザーコーチング、クラス最高のデータ保護により、生成型AIアプリケーションを安全に使用できるようにします。

ジェネレーティブ AI の使用を保護する方法を学ぶ
Safely Enable ChatGPT and Generative AI
SSEおよびSASE展開のためのゼロトラストソリューション

Learn about Zero Trust
Boat driving through open sea
Netskopeは、クラウドサービス、アプリ、パブリッククラウドインフラストラクチャを採用するための安全でクラウドスマートかつ迅速な旅を可能にします。

Learn about Industry Solutions
Wind turbines along cliffside
  • 導入企業

    Netskopeは、フォーチュン100の25以上を含む世界中の2,000以上の顧客にサービスを提供しています。

  • カスタマーソリューション

    お客様のため、Netskopeでお客様の成功を確実にすべく、あらゆるステップを共に歩んでまいります。

  • トレーニングと認定

    Netskope training will help you become a cloud security expert.

私たちは、お客様が何にでも備えることができるように支援します

お客様を見る
Woman smiling with glasses looking out window
Netskopeの有能で経験豊富なプロフェッショナルサービスチームは、実装を成功させるための規範的なアプローチを提供します。

Learn about Professional Services
Netskopeプロフェッショナルサービス
Netskopeトレーニングで、デジタルトランスフォーメーションの旅を保護し、クラウド、ウェブ、プライベートアプリケーションを最大限に活用してください。

Learn about Training and Certifications
Group of young professionals working
  • リソース

    クラウドへ安全に移行する上でNetskopeがどのように役立つかについての詳細は、以下をご覧ください。

  • ブログ

    Netskopeがセキュリティサービスエッジ(SSE)を通じてセキュリティとネットワークの変革を可能にする方法を学びましょう。

  • イベント&ワークショップ

    最新のセキュリティトレンドを先取りし、仲間とつながりましょう。

  • 定義されたセキュリティ

    サイバーセキュリティ百科事典で知っておくべきことすべて。

セキュリティビジョナリーポッドキャスト

ボーナスエピソード2:SSEのマジッククアドラントとSASEを正しく取得する
MikeとSteveが、ガートナー®社のマジック・クアドラント™のセキュリティ・サービス・エッジ(SSE)、Netskopeの位置づけ、現在の経済情勢がSASEの取り組みに与える影響について語ります。

ポッドキャストを再生する
ボーナスエピソード2:SSEのマジッククアドラントとSASEを正しく取得する
最新のブログ

Netskopeがセキュリティサービスエッジ(SSE)機能を通じてゼロトラストとSASEの旅を可能にする方法。

ブログを読む
Sunrise and cloudy sky
ネツコペAWSイマージョンデイワールドツアー2023

Netskopeは、Netskope製品の使用とデプロイについてAWSのお客様を教育および支援するために、さまざまなハンズオンラボ、ワークショップ、詳細なウェビナー、およびデモを開発しました。

Learn about AWS Immersion Day
AWS パートナー
セキュリティサービスエッジとは何ですか?

SASEのセキュリティ面、ネットワークとクラウドでの保護の未来を探ります。

Learn about Security Service Edge
Four-way roundabout
  • 会社概要

    クラウド、データ、ネットワークセキュリティの課題の先取りをサポート

  • ネットスコープが選ばれる理由

    クラウドの変革とどこからでも機能することで、セキュリティの機能方法が変わりました。

  • リーダーシップ

    ネットスコープの経営陣はお客様を成功に導くために全力を尽くしています。

  • パートナー

    私たちはセキュリティリーダーと提携して、クラウドへの旅を保護します。

データセキュリティによる持続可能性のサポート

Netskope は、持続可能性における民間企業の役割についての認識を高めることを目的としたイニシアチブであるビジョン2045に参加できることを誇りに思っています。

詳しくはこちら
Supporting Sustainability Through Data Security
Highest in Execution. Furthest in Vision.

ネットスコープは2023年Gartner®社のセキュリティ・サービス・エッジ(SSE)のマジック・クアドラント™でリーダーの1社として評価されました。

レポートを読む
ネットスコープは2023年Gartner®社のセキュリティ・サービス・エッジ(SSE)のマジック・クアドラント™でリーダーの1社として評価されました。
思想家、建築家、夢想家、革新者。 一緒に、私たちはお客様がデータと人々を保護するのを助けるために最先端のクラウドセキュリティソリューションを提供します。

当社のチーム紹介
Group of hikers scaling a snowy mountain
Netskopeのパートナー中心の市場開拓戦略により、パートナーは企業のセキュリティを変革しながら、成長と収益性を最大化できます。

Learn about Netskope Partners
Group of diverse young professionals smiling

Netskope Threat Coverage: BlackMatter

Aug 23 2021

Summary

In July of 2021, a new ransomware named BlackMatter emerged and was being advertised in web forums where the group was searching for compromised networks from companies with revenues of $100 million or more per year. Although they are not advertising as a Ransomware-as-a-Service (RaaS), the fact they are looking for “partners” is an indication that they are operating in this model. Furthermore, the group is claiming to have combined features from larger groups, such as DarkSide and REvil (a.k.a. Sodinokibi).

Screenshot of BlackMatter advertisement in a web forum.
BlackMatter advertisement in a web forum. (Source: The Record)

According to an interview with an alleged representative from BlackMatter, they have incorporated the ideas of LockBit, REvil, and DarkSide, after studying their ransomware in detail. Also, the BlackMatter representative believes that other ransomware groups have disappeared from the scene due to attention from governments following high-profile attacks.  BlackMatter plans to avoid such attention by being careful not to infect any critical infrastructure. This is echoed on their website, which states they are not willing to attack hospitals, critical infrastructures, defense industry, and non-profit companies.

Screenshot of Main page of BlackMatter’s website, hosted on the deep web.
Main page of BlackMatter’s website, hosted on the deep web.

The oil and gas industry is also excluded from the target list, a reference to the Colonial Pipeline attack where DarkSide stopped the fuel delivery across the Southeastern of the United States, followed by the shut down of the ransomware operation due to the pressure from law enforcement. The BlackMatter spokesperson also said that the Colonial PIpeline attack was a key factor for the shutdown of REvil and DarkSide, and that’s why they are excluding this kind of sector from the target list.

BlackMatter already claims to have hit three victims, each listed on their deep web site, which follows the same standard from other groups, containing the name of the attacked company, a summary of what data they have stolen, and the deadline for the ransom before the data is published.

Screenshot showing one of the DarkSide targets, with leaked data on the website.
One of the DarkSide targets, with leaked data on the website.

One of the companies infected by BlackMatter is SolarBR, which is the second-largest manufacturer of Coca-Cola in Brazil, where the group claimed to have stolen 50 GB of confidential finance, logistics, development, and other data.

Screenshot showing that Solar Coca-Cola was infected by BlackMatter
Solar Coca-Cola infected by BlackMatter

According to the post, if the ransom isn’t paid, the group will publish the data and inform all of the “biggest mass-media in Brazil and US,” making “Coca Cola and her lovers” to be “madly angry”.

Screenshot of additional information from BlackMatter’s deep web site.
Information from BlackMatter’s deep web site.

There is no official information about the ransom amount BlackMatter is requesting from Solar Coca-Cola, but the deadline is set to August 23, 2021.

In this threat coverage report, we will analyze a Windows BlackMatter sample, version 1.2, describing some of the key features of the malware. 

Threat

Like other malware, BlackMatter implements many techniques to avoid detection and make reverse engineering more challenging. The first item we would like to cover is how BlackMatter dynamically resolves API calls to hide them from the PE import table.

This is done by a multi-step process. First, the malware creates a unique hash that will identify both the DLL and API name that needs to be executed. To make this a bit harder for static detections, the real hash value is encrypted with a simple XOR operation. In this case, the key is 0x22065FED.

Figure showing function that loads the import based on a hash.
Figure 1. Function that loads the import based on a hash.

In the example above, after the XOR operation, the value 0x27D05EB2 is passed as a parameter to the function responsible for searching and loading the API. The code first enumerates all the DLLs that are loaded within the process through a common but interesting technique. 

First, it loads the Process Environment Block (PEB) address, which is located in the Thread Environment Block (TEB). Then, it loads the doubly linked list that contains all the loaded modules for the process, located in the PEB_LDR_DATA structure.

Figure showing BlackMatter function searching loaded modules using the PEB.
Figure 2. BlackMatter function searching loaded modules using the PEB.

Once the loaded DLL is located, the function retrieves the DLL’s offset, finds the PE header address, and then calculates the offset of the PE export directory, so it can enumerate the APIs exported by the DLL.

If the export table is found, the ransomware then calculates the hash value for both DLL and API name, using the following function:

Figure showing the function used by BlackMatter to calculate the hash of the string.
Figure 3. Function used by BlackMatter to calculate the hash of the string.

To get the unique hash, the ransomware first calculates the hash only for the DLL name.

Figure showing hash generation for the DLL “kernel32.dll”
Figure 4. Hash generation for the DLL “kernel32.dll”

In the example above, the hash for the DLL “kernel32.dll” is 0xB1FC7F66, which is then used by this same function to calculate the hash of the API name.

Figure generating the final hash for DLL + API name
Figure 5. Generating the final hash for DLL + API name

Therefore, using the same function again, the malware has generated the hash 0x27D05EB2 for the DLL “kernel32.dll” and the API “LoadLibraryA”, which is exactly the same value the malware is seeking, as demonstrated in Figure 1.

If the hash generated by the function matches the hash the malware passed as a parameter, the offset for the API is stored in memory, so the function can be called.

Figure showing BlackMatter’s code before and after the APIs were dynamically resolved.
Figure 6. BlackMatter’s code before and after the APIs were dynamically resolved.

Several DLLs are loaded by BlackMatter dynamically after the executable is running, as we can see below.

Figure showing DLLs dynamically loaded by BlackMatter.
Figure 7. DLLs dynamically loaded by BlackMatter.

To make the analysis faster, we’ve created a script that implements the same logic used by BlackMatter for the hash generation. Therefore, the script can be used to locate calls to specific APIs across BlackMatter’s code.

Figure showing script to generate the hash based on the API call.
Figure 8. Script to generate the hash based on the API call.

Another technique used by BlackMatter to stay under the radar is to encrypt all its important strings. In the samples we’ve analyzed, the ransomware used the same key as the one used to generate the hashes for the API loading process.

Figure showing BlackMatter’s routine for string decryption.
Figure 9. BlackMatter’s routine for string decryption.

After the bytes are organized in memory, the code decrypts the data in 4-byte blocks, using a simple XOR operation with the key 0x22065FED.

Figure showing example of a string decrypted by BlackMatter.
Figure 10. Example of a string decrypted by BlackMatter.

We can find useful information across the decrypted strings, such as registry keys, file names, and others. The full list of decrypted strings can be found in our GitHub repository.

Figure showing some of BlackMatter’s decrypted strings.
Figure 11. Some of BlackMatter’s decrypted strings.

BlackMatter also has an encrypted configuration inside the binary, located in a fake PE resource section.

Figure showing BlackMatter’s encrypted configuration.
Figure 12. BlackMatter’s encrypted configuration.

The first 4 bytes in the section are the initial decryption key, the following 4 bytes represent the size of the data, and the rest of the bytes are the encrypted configuration. The data is then decrypted using a rolling XOR algorithm.

A new decryption key is generated every 4 bytes, using a dynamic seed and a constant, which is 0x8088405 in all the samples we have analyzed so far.

Figure showing the stub that generates the decryption key.
Figure 13. Stub that generates the decryption key.

The decrypted configuration is compressed using aPLib, so we need to decompress the bytes to get the information. Once this process is done, we can read the contents of the configuration. At the beginning, we can find the attacker’s RSA public key, the AES key used to encrypt C2 communication, as well as a 16-byte value named “bot_company”.

Figure showing BlackMatter’s decrypted configuration.
Figure 14. BlackMatter’s decrypted configuration.

Aside from that, the configuration also includes several base64 encoded strings that contain sensitive strings used by the malware, like the C2 server addresses.

Figure decoding BlackMatter’s C2 server addresses.
Figure 15. Decoding BlackMatter’s C2 server addresses.

Among the strings, there is also a list of processes and services that the ransomware attempts to stop \ terminate.

Figure showing ransomware trying to open the VSS service.
Figure 16. Ransomware trying to open the VSS service.

To speed up the analysis, we have created a script that is able to decrypt the strings and the configuration from BlackMatter samples.

Figure decrypting BlackMatter’s strings.
Figure 17. Decrypting BlackMatter’s strings.

The script also decodes all base64 values from the configuration automatically:

Figure showing BlackMatter’s C2 server addresses.
Figure 18. BlackMatter’s C2 server addresses.

BlackMatter communicates with the C2 server in order to send information to the attackers. It first loads a JSON structure in memory, containing all the information that will be sent.

Figure showing information that will be sent to the C2 address.
Figure 19. Information that will be sent to the C2 address.

Prior to the POST request, the information is encrypted using AES-128 ECB, with the key extracted from the configuration, and then encoded with base64.

Figure showing BlackMatter sending request to the C2 server.
Figure 20. BlackMatter sending request to the C2 server.

It’s possible to decrypt this information by decoding the base64 and decrypting the data using the key from the configuration file.

Figure decrypting BlackMatter’s C2 request.
Figure 21. Decrypting BlackMatter’s C2 request.

BlackMatter sends two requests, the first one contains details about the infected environment, and the second one contains details about the encryption process, such as how many files failed to encrypt, the start and end time, etc.

Finally, once the encryption process is complete, the ransom note is created in the same places where there are encrypted files.

Figure showing BlackMatter’s ransom note.
Figure 22. BlackMatter’s ransom note.

BlackMatter changes the background image, a common practice among ransomware creators.

Figure showing BlackMatter’s custom background
Figure 23. BlackMatter’s custom background

Protection

Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads. 

  • Netskope Threat Protection
    • Trojan.GenericKD.46740173
    • Gen:Heur.Mint.Zard.25
  • Netskope Advanced Threat Protection provides proactive coverage against this threat.
    • Gen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis
    • Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox

IOCs

SHA256

22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6

2c323453e959257c7aa86dc180bb3aaaa5c5ec06fa4e72b632d9e4b817052009

7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984

c6e2ef30a86baa670590bd21acf5b91822117e0cbe6060060bc5fe0182dace99

A full list of IOCs, a Yara rule, and the scripts used in the analysis are all available in our Git repo.

author image
Gustavo Palazolo
Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection. He is currently working on the Netskope Research Team, discovering and analyzing new malware threats.