Overview

overview

10

Static

static

10

daed41395b...20.exe

windows7_x64

3

daed41395b...20.exe

windows10_x64

3

Resubmissions

16-09-2021 19:52

210916-ylfhfaecb8 10

02-08-2021 22:19

210802-12e6dd3jde 3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.zip

  • Size

    36KB

  • MD5

    b6e20a3378a63ba2d38bc299bd61b5c0

  • SHA1

    caa1ebc1d54cf0bc0048a374515c2f0f2b732d85

  • SHA256

    83ac6dd25820e1b6b826c2d52a28bf71506fec4f8320d4f51f3a0cfd739502f3

  • SHA512

    500a905f881248bbc8af3df9a087f27a802fbcf15ae1a4c95d4184a3f88bacd6f662863a48861b18907e0d9c4c1162c7edfea7a56f5124a347192ccf22b52f0e

Score
10/10
512478c08dada2af19e49808fbda5b0bblackmatter

Malware Config

Extracted

Family

blackmatter

Version

1.2

Botnet

512478c08dada2af19e49808fbda5b0b

Credentials

  • Protocol:     smtp
  • Port:
    587
  • Username:
    aheisler@hhcp.com
  • Password:
    120Heisler

  • Protocol:     smtp
  • Port:
    587
  • Username:
    dsmith@hhcp.com
  • Password:
    Tesla2019

  • Protocol:     smtp
  • Port:
    587
  • Username:
    administrator@hhcp.com
  • Password:
    iteam8**
C2

https://paymenthacks.com

http://paymenthacks.com

https://mojobiden.com

http://mojobiden.com
Attributes
  • attempt_auth

    true

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Signatures

Files

  • daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.zip
    .zip

    Password: infected

  • daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
    .exe windows x86