General
-
Target
5386762618830848.zip
-
Size
44KB
-
MD5
33fd1eff1384b58c7bc81c0a5b703435
-
SHA1
18b161012aa788b9bbcd86d321c3ad09ac15c278
-
SHA256
2cb8565c23b7c833776a89e66cc0668024a8802799c349a31931221a54c73d2e
-
SHA512
28f1d238a70deb3f6267da00e2b13edba495da7a6ddcadf421a4846b64e902bf1dee047f563941f140da7dc4c3e89f8ad12c674c80532a4fccbdf379b21eae63
Score
10/10
Malware Config
Extracted
Family
blackmatter
Version
2.0
Botnet
14a875a2bd63041b2b3e5c323e8d5eee
Credentials
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
Voyager1701!!!
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
HereGoes321
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
QApassw0rd
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
Aug21!!!
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
Glasgow0315
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
Eleanor22
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
Glasgow0315
C2
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
Attributes
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
rsa_pubkey.base64
aes.base64
Signatures
-
Blackmatter family
Files
-
5386762618830848.zip
Password: infected
-
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4