ExMatterMalware
Exfiltration tool written in. NET, used by at least one BlackMatter ransomware operator.From MISP Galaxy
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
6 of 67 · each with the sentence it comes from- T1003OS Credential Dumping
“T1003.001 OS Credential Dumping: LSASS Memory”
- T1003.001LSASS Memory
“T1003.001 OS Credential Dumping: LSASS Memory”
- T1005Data from Local System
“T1005 Data from Local System”
- T1007System Service Discovery
“T1007 System Service Discovery”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
- T1018Remote System Discovery
“T1018 Remote System Discovery”
What the reports say
1 report, newest first · the exact sentence from each-
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies“In some cases, affiliates used ExMatter, an exfiltration tool that was seen earlier in the arsenal of BlackMatter affiliates.”
Thanks — we review every report.