General

  • Target

    daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.zip

  • Size

    36KB

  • Sample

    210916-ylfhfaecb8

  • MD5

    b6e20a3378a63ba2d38bc299bd61b5c0

  • SHA1

    caa1ebc1d54cf0bc0048a374515c2f0f2b732d85

  • SHA256

    83ac6dd25820e1b6b826c2d52a28bf71506fec4f8320d4f51f3a0cfd739502f3

  • SHA512

    500a905f881248bbc8af3df9a087f27a802fbcf15ae1a4c95d4184a3f88bacd6f662863a48861b18907e0d9c4c1162c7edfea7a56f5124a347192ccf22b52f0e

Malware Config

Extracted

Family

blackmatter

Version

1.2

Botnet

512478c08dada2af19e49808fbda5b0b

Credentials

Protocol: smtp

Host:

Port: 587

Username: aheisler@hhcp.com

Password: 120Heisler

Protocol: smtp

Host:

Port: 587

Username: dsmith@hhcp.com

Password: Tesla2019

Protocol: smtp

Host:

Port: 587

Username: administrator@hhcp.com

Password: iteam8**

C2

https://paymenthacks.com

http://paymenthacks.com

https://mojobiden.com

http://mojobiden.com

Attributes
attempt_auth
true
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true
rsa_pubkey.base64
aes.base64

Targets

    • Target

      daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe

    • Size

      67KB

    • MD5

      e6b0276bc3f541d8ff1ebb1b59c8bd29

    • SHA1

      295de44a0adbef57c51458978ccd71437aff0bf1

    • SHA256

      daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720

    • SHA512

      cdc851b9a7dc396384cbd69353f4e594cb3ac80679abfaa9ebf7bf849bca1b2e2c233c9634239e4aaa4e7f02a2af096733bef1b760ae0e6d660918217cecdcee

    Score
    3/10

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation