General
-
Target
daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.zip
-
Size
36KB
-
MD5
b6e20a3378a63ba2d38bc299bd61b5c0
-
SHA1
caa1ebc1d54cf0bc0048a374515c2f0f2b732d85
-
SHA256
83ac6dd25820e1b6b826c2d52a28bf71506fec4f8320d4f51f3a0cfd739502f3
-
SHA512
500a905f881248bbc8af3df9a087f27a802fbcf15ae1a4c95d4184a3f88bacd6f662863a48861b18907e0d9c4c1162c7edfea7a56f5124a347192ccf22b52f0e
Score
10/10
Malware Config
Extracted
Family
blackmatter
Version
1.2
Botnet
512478c08dada2af19e49808fbda5b0b
Credentials
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
120Heisler
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
Tesla2019
Protocol: smtp- Port:
587 - Username:
[email protected] - Password:
iteam8**
C2
https://paymenthacks.com
http://paymenthacks.com
https://mojobiden.com
http://mojobiden.com
Attributes
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
rsa_pubkey.base64
aes.base64
Signatures
-
Blackmatter family
Files
-
daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.zip
Password: infected
-
daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe