> Family · BlackMatter_

~/packetpursuit $ cat /intel/families/blackmatter.md

typeentityfamilyblackmatterconfidencelowupdated2026-09-04malware-familyloaderransomwaremalware-bazaarattribution

BlackMatter

OpenCTI label for a cluster of PE32 GUI samples (150 KB, Sep 9 2022) tagged blackmatter and dropped-by-phorpiex. Static analysis shows these are reflective loaders, not ransomware. The blackmatter label in this corpus appears to be a false-positive family attribution or umbrella tag applied by the upstream connector. The actual binary is an MSVC 14.12 reflective loader with PEB-walking API resolution, XOR-NOT alphabet cipher, CPUID anti-VM, and LCG-based C2 URL generation — identical to the unattributed sample 136b5750.

Build Pattern

  • Toolchain: MSVC 14.12 (VS 2017 15.5+), POGO optimized (IMAGE_DEBUG_TYPE_POGO)
  • Architecture: PE32 x86, Windows GUI subsystem
  • Mitigations: ASLR, DEP/NX, stack canary — all enabled
  • Signing: Unsigned
  • Imports: Minimal facade — GDI32 (6), USER32 (11), KERNEL32 (8) GUI functions only
  • Sections: .text, .itext, .rdata, .data, .pdata, .reloc
  • Anti-analysis: CPUID hypervisor-bit checks + RDTSC timing gate
  • API resolution: PEB-walking InMemoryOrderModuleList with export-name hashing; ~30+ threat APIs resolved at runtime and cached in .data pseudo-import table

Capabilities

  • peb-walking-api-resolution
  • xor-not-string-cipher
  • lcg-prng-c2-url-generation
  • cpuid-hypervisor-vm-gate
  • rdtsc-timing-anti-emulation
  • reflective-pe-loader
  • virtualalloc-rwx-memmove
  • cryptencrypt-c2-payload
  • findfirstfile-recursive-enumeration
  • wininet-http-post-c2
  • runtime-alphabet-table-generation
  • msvc-pogo-reflective-loader

Cluster

All thirty-nine samples share the identical compilation timestamp (0x631A9665), linker version (14.12), and XOR key (0x10035fff).

SHA-256 Prefix Status Notes
9d8526b0 Analysed First report; individualized .data payload
136b5750 Analysed Primary unattributed report; identical stub
0b525c35 Triage only Same stub, no report
370415c8 Triage only Same stub, no report
c527ebf0 Triage only Same stub, no report
d715b248 Analysed Forty-first confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x263B2, individualized .data payload (SHA-256 36c9cacc...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.html]
dc870a75 Triage + report Eighth confirmed sibling; individualized .data payload, PE checksum 0x0002A237
73841818 Analysed Ninth confirmed sibling; individualized .data payload, PE checksum 0x000306CE
0017ecc5 Analysed Tenth confirmed sibling; individualized .data payload, PE checksum 0x0002FF42
34ca794e Analysed Eleventh confirmed sibling; individualized .data payload, PE checksum 0x00026DC4
a2dca6ef Analysed Twelfth confirmed sibling; individualized .data payload, PE checksum 0x28FB1
cdc7d79a Analysed Thirteenth confirmed sibling; individualized .data payload, PE checksum 0x000326E1
ae02bd22 Analysed Fourteenth confirmed sibling; individualized .data payload, PE checksum 0x0002BE18, .text hash matches 21b12514, dropped-by-phorpiex tag but no blackmatter label ^[/intel/analyses/ae02bd22cede04bdb3d48b0e32a9611c9352f28e2ddaf56af55112fdb8b2cc17.html]
7e9bbc5c Analysed Fifteenth confirmed sibling; individualized .data payload, PE checksum 0x0002688E, .text hash matches ae02bd22 and 21b12514, dropped-by-phorpiex tag, no blackmatter label ^[/intel/analyses/7e9bbc5c0e10efd2ae5509243895cc74a242051cd48ad08055e99ac9da0ee781.html]
877f1047 Analysed Sixteenth confirmed sibling; individualized .data payload, PE checksum 0x00031DEB, .text hash divergent from ae02bd22/21b12514 group, dropped-by-phorpiex tag only (no blackmatter label) ^[/intel/analyses/877f1047825cb5b73a4812279ac15e8987290c99a5d3a99473a9ec85066fabd6.html]
e67dbabcd Analysed Seventeenth confirmed sibling; individualized .data payload, PE checksum 0x32ac3, .text hash matches majority group, dropped-by-phorpiex tag only, no blackmatter label ^[/intel/analyses/e67dbabcd48b1294883b07d7724f416a77963c79aaf9d81bed9d7e2d0dcd9731.html]
2ac8295381 Analysed Eighteenth confirmed sibling; individualized .data payload, PE checksum 0x63206d61, .text hash matches majority group, dropped-by-phorpiex tag only, no blackmatter label ^[/intel/analyses/2ac8295381ebafbe6399707f5435409e859c7c08bf51c666db4438ea5e4a4abb.html]
89dc341bbd Analysed Nineteenth confirmed sibling; individualized .data payload (SHA-256 fb719c10...), PE checksum 0x297db, .text hash matches majority group, dropped-by-phorpiex tag only, no blackmatter label ^[/intel/analyses/89dc341bbd176fbcee31f54884c132faf7c847838609f330249f634b99fd0a0c.html]
8655b3b9b2 Analysed Twentieth confirmed sibling; individualized .data payload (SHA-256 035c5d8e...), PE checksum 0x2ebd4, .text hash matches majority group, dropped-by-phorpiex tag only, no blackmatter label ^[/intel/analyses/8655b3b9b297ef153354a4f9778d7b621dd94adf4ca66d526cd7f0095b7fe5d4.html]
91e39f6bb60a Analysed Twenty-first confirmed sibling; individualized .data payload (SHA-256 108818f3...), PE checksum 0x33158, .text hash matches majority group, dropped-by-phorpiex tag only, no blackmatter label ^[/intel/analyses/91e39f6bb60a3860e6d1dc1fb711a8865281407614d5d106d03678c8723f2ddf.html]
65844473d39b Analysed Twenty-second confirmed sibling; individualized .data payload (SHA-256 cca2478b...), PE checksum 0x2b4ee, .text hash matches majority group, dropped-by-phorpiex tag only, no blackmatter label ^[/intel/analyses/65844473d39bb5b0cc86715b2da6da6fbb8dc12730d5a6caf972d132d74542f0.html]
044539a2eacf Analysed Twenty-third confirmed sibling; .text hash matches majority group, PE checksum 0x2BA22, individualized .data payload (SHA-256 3279ce70...), dropped-by-phorpiex tag only, no blackmatter label ^[/intel/analyses/044539a2eacfd520e93aecc7f977b7ebea9d15c941a7101f5682ccb9fec68e1f.html]
f016df16d0f3 Analysed Twenty-fourth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x306e9, individualized .data payload (SHA-256 e4c7fc94...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/f016df16d0f34aaae36bf10e0ca6bccdce2a4d552fcc6444e6f48318ef0b2c4a.html]
a397bea4c70b Analysed Twenty-fifth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x31603, individualized .data payload (SHA-256 5271c3df...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/a397bea4c70bf3264348c88fca652fcbb2d421832672fa58a790af67bf419469.html]
93da3f615d04 Analysed Twenty-sixth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x2bfa9, individualized .data payload (SHA-256 7bc28648...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/93da3f615d041dc37a4b3db4a3d0c60bfd3c3fb1fc3ff4d5b764c646b629da7b.html]
0cd5240c6961 Analysed Twenty-seventh confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x287d2, individualized .data payload (SHA-256 3c359767...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/0cd5240c696194cf2eb701cd4d4ca81e7f17612a4042ebb56959008d66537b4b.html]
92fc7f45d496 Analysed Twenty-eighth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x27b0a, individualized .data payload (SHA-256 8f789bb9...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/92fc7f45d4968df95bc082220680c9ebd6a381a9467f77493878af031454d633.html]
c9417d468332 Analysed Twenty-ninth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x2A989, individualized .data payload (SHA-256 1a1ee067...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/c9417d4683324c34c7b976395c01f79150a626966e27144244214423aa64ccde.html]
1985db0655bc Analysed Thirtieth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x2e30c, individualized .data payload (SHA-256 f6188dd1...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/1985db0655bca27343a13d8607904c53a292459083daa8c92ae2f71a5408b40a.html]
53e315669d72 Analysed Thirty-first confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x257e3, individualized .data payload (SHA-256 4ec281cf...), dropped-by-phorpiex tag only, no blackmatter label. Static-only. ^[/intel/analyses/53e315669d72051a4add2e28938733dc116bb46fdc05dcda1958e7ea466812ed.html]
8796e69f738f Analysed Thirty-second confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x2E93A, individualized .data payload (SHA-256 580e7e7f...), dropped-by-phorpiex tag only, no blackmatter label. Static-only. ^[/intel/analyses/8796e69f738fceb99fd177a5536dbccf5112ffa202a8b05be10ab45e600e289b.html]
326536a0bcb9 Analysed Thirty-third confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x2A4A9, individualized .data payload (SHA-256 376aa1c5...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/326536a0bcb9198049da10f4873446393c0f7ceb91098aecdd39a94f6d691112.html]
06fe6a157bd3 Analysed Thirty-fourth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x27367, individualized .data payload (SHA-256 aa830e60...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/06fe6a157bd3f67ae9f7cdf3478a0db670c2772b584cae5900d2473b6b109bb7.html]
34f9b16d363f Analysed Thirty-fifth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x31f6e, individualized .data payload (SHA-256 58c7f053...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/34f9b16d363f1bd44d912a62ee0745985ac696b6c4aaf4799a9b2b37d11720e8.html]
80d36c0476b5 Analysed Thirty-sixth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x29437, individualized .data payload (SHA-256 142e1ef8...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/80d36c0476b5de983271b65665bb6997eb58316bc3c151f04b045f45ef80784c.html]
e040fac4e5b2 Analysed Thirty-seventh confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x272B7, individualized .data payload (SHA-256 c60e6120...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/e040fac4e5b29fbe7606c2d39372935a8aee80a3167c7521efabc7c3e002a242.html]
2e3876a4 Analysed Thirty-eighth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x2FA78, individualized .data payload (SHA-256 795b3d29...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/2e3876a4a2e1d7456dbc95a254b419de25a9b26d2bab3d98d8c9ff0faa43b48c.html]
1e399538c41b Analysed Thirty-ninth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x2F0F2, individualized .data payload (SHA-256 b0d33d9f...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/1e399538c41be1c39566a00c95b78b39186510254e24562ec53a414ad74c23a1.html]
cf3befb087ca Analysed Fortieth confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x2C7F5, individualized .data payload (SHA-256 0b3d6cb1...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/cf3befb087ca768d1dcd4eee9dc75c9adb1ca26bce74865c9005da1c2c794274.html]
bc93fb67 Analysed Forty-second confirmed sibling; .text hash matches majority group (cfbda2c4...), PE checksum 0x28702, individualized .data payload (SHA-256 8c53c2db...), dropped-by-phorpiex tag and blackmatter label. Static-only. ^[/intel/analyses/bc93fb67cf4dba8c35e91b551ca3190db25ffa4a36f821bc5a6b900927470fb9.html]

Attribution

  • Delivery: Phorpiex spam infrastructure (dropped-by-phorpiex tag) ^[phorpiex.md]
  • Payload family: Unknown / unattributed — not BlackMatter ransomware
  • Confidence: Low — the blackmatter label is not supported by static evidence

Related Pages