E# r��z�z%�`��p���o�R��)^*cH�).|�6D��pD1A�퉦gW�z-���3M\6�$V��O.���e9�h�Ҵ:����&�A�) \�}�������t�]��c9��Nk�#�듹c��mWZ93WS�v�i�Xv�zPTt:*-���;��L@�����]��S2��y�|,f��uO�K��:d�b��d|\b�Z��̟�r�\,,*a�p�ڧ8BF>h�e�6G�<���A_�ZQ��T䦂�ٝ7lb�AM�[��W����^���*�� x=����\Gs�~{Xu3 ENΌ;� ^ft�� �^�v�Ǎ��g���E�"FE糜9��B������oE�a�����&@�x� ��J��1�(+,�.�#I����1s�b�^8�7���v���\a��3s�/��������2��e���[P��W��\C3�oa�f 8�5�4On�ZRM�}�n�-b4�G�).KTe��}��wg��Z4xF��P���9a�: wC)9ڕ�t����Wg��E"���2��) =�5#c�[��Eh�^���D��S5sw��>K���6:>5�ꎳUt�a;.*;17���7�[�K��@DiT�t._�e���31�& �b�����B'$��t���dXl��E���S��!Qz�v|�1�ε�ԙ�x^;9ɤ>���C�{|9� <!�C�_l��.��z�C�D��m�кvH4F"T���T�Y�s����o6j���%L�Ԋ�}d�X�4�E�ɐZ�KUg����] 7}B�2%xj��2%���k�������e��-����/H!Ӭm?v�z��X�->�Nk�@��ä��5� �H��=�6�<Φ��Y��>�"\~�F�Q*>ixQLԃbɁQK8jt��3tKuA��a�>�F�4)��6�q6�i�� ��0 L~��'w�v2��*uyt50b�!?I`v8�u����zaug�S�����逰1�X�r���]Ɍ�@��P9O�P"%�y�Ƽ�j�S;��mcU�����6����̨�8��@��:�=�о*�(���c- �i�_wt�o ��J�ϋ��UܗL�jI�)�@!�N�&N�=e{W]���: ֹ��������F��]�����Sk���w2�\���P� �����c|"�6aܸ�<r��4r�XC�$�.7�H?�}��\qo����tS� ӓ����g/� k\B��2�p���⥖��kt�b�Z:��C Z�� 3���E�:8Y#��)Qe����j8n^)e <Z$���D��P�C��ʏ�7ȴ����T*��ն�a��.�t~WB���-��N�����<�]x�%��<����H��K�[R��5g\آ��p"v�Q��<����>w^A�I��]��7Aǧ�@?�����C��H�}��C撛������猺�$�w��9�l�ɮ;m�a�4d��b�X���?H�p��Ƀ�S%��d�]"��u�8$Ԅ+�8rDȩ����e_>T�tL����`ZC�f�rk��[���+<5�*�m,�>q� !�ݽ1�a��b����RV���V��o�B��hC�v��:�͊���~���>��ˉ�4��c�X�\�H����r�$�T��q5�L�Ϩ./��%�`#�N��Y$��k9�a�k��~�c%%Tg�-��{��Dp.���a�F�ewH���`�4��%��J殀��G�a�0�-@�T] 11p}������ş���y#X�k��(�9�i�y������O6{#�GƳ�*b�-R ��<u�â�{�&�bVW��E�X�f��_t�,Ԥ��BX��T$�X�� ���Z�,uAv��L���+� u�_����D��uh�̏�߁������Y�Xښ\)E:u.{����>^��wv�;��KCk�+X �)�pe��~hBAm�q7��3U�_2���(a����|j�n����i�[�Eiw ���=�ر�/�w;�cLx��^��u[N\�6�� ��Zv�q4I�a�R� �m >sc ���������z�1�'0v�^zW?����}��6�wD���2qj���U�ǁ��b���'pa���Ѕ�۞&{5!�.���նH�2���������-DyNqkͰ��9*ug�N}��"9@��M�+��>: �S��j"�優`R�M$������j����v��ˈ0����`�;8@�/0?@���ݰ��G���- 1{uNW��:.�U),>����,�(��x�X&����ԗ+�*��|�^D {��5ͫ���P� �c|�a�S��T�A44��5gv��}�6�Mjb� Chz$�i.d ����~b�.v�>��}&����Ok^Kȹt�i��͐��i���O�i��S�`ʃ�������R����J�G3۠��eEm\�b�@p�zP�P"pw�.%ՌH��Nb,BC�,5��#f�>iz�_}���ѦtV���ҍ�%W�Nm ����F��@$`\��������|)�$�ET�?�ϱ�魖��BX�����`:�>S�|y%c�Hɣ1���T^-D�P����6.�L����cG{Y"���_@��Q 0G��5IwO:�r�;��Zև��U�ǐ��:��&���_X�� ����ܩ,�����qv!�/�8���m�2�2�&57���^y$[�p����oNAt�����2�R�A�攌����&n�n�X4�gT�J���G�e���Qʠ|�&�� 젩ֲ"vpo��+hIg)AN'ذ)"1��yg�313G��7jqn3*:���,X�%Q+I���w�,�گ~��&�?1\]'�Q�3�ڠ����E'?&�V�)#�܁V��-�����:i��S���h5Ћ9 ��_�G$-м�GV���%}�za�O�ю�%Xl�\ b5gI*�R�Os}�Q��]V���{��4��D6n�4B( �>��U��q ~�eAJ�Z�ݬ�-�1�O���3Yc�����'z��ț<!}{��_Ȯ�( �����\�>d J���ﵻ���`B��w��W��د�)8A�sOǚ䉷�����j��K4q#��u�ÿgX$uۑ���q�R@R}TdxpZ #A��l�(���1�q��V�eښ��tg�E9��lC��~m�_�N ]|�����K� ��l�# �%��Cl��~Ǣw�u�;���|!���\�a�����/��:�/V�kw"#����k��͊�0�n�id?�$��7�G��nF�j ���ˑ���N���%��Ě�~��1�7��dd�2%C;����B��JZ�����Aٜ��?���*E�hDmpW
Overview
overview
10Static
static
10072158f558...86.exe
windows7_x64
10072158f558...86.exe
windows10_x64
100751c42296...a4.exe
windows7_x64
100751c42296...a4.exe
windows10_x64
1014a3e308c9...5c.exe
windows7_x64
314a3e308c9...5c.exe
windows10_x64
31c63a4fdee...49.exe
windows7_x64
101c63a4fdee...49.exe
windows10_x64
101eea3cbd72...c2.exe
windows7_x64
101eea3cbd72...c2.exe
windows10_x64
1020742987e6...41.exe
windows7_x64
1020742987e6...41.exe
windows10_x64
1022d7d67c3a...d6.exe
windows7_x64
1022d7d67c3a...d6.exe
windows10_x64
102466fca0e2...4c.exe
windows7_x64
102466fca0e2...4c.exe
windows10_x64
102aad85dbd4...7c.exe
windows7_x64
102aad85dbd4...7c.exe
windows10_x64
102c323453e9...09.exe
windows7_x64
102c323453e9...09.exe
windows10_x64
102cdb5edf30...fd.exe
windows7_x64
102cdb5edf30...fd.exe
windows10_x64
102e50eb85f6...b2.exe
windows7_x64
102e50eb85f6...b2.exe
windows10_x64
103a03530c73...17.exe
windows7_x64
103a03530c73...17.exe
windows10_x64
103a4bd5288b...40.exe
windows7_x64
103a4bd5288b...40.exe
windows10_x64
104ad9432cc8...91.dll
windows7_x64
104ad9432cc8...91.dll
windows10_x64
104be85e2083...2b.exe
windows7_x64
104be85e2083...2b.exe
windows10_x64
10Static task
static1
Behavioral task
behavioral1
Sample
072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486.exe
Resource
win10-en-20211104
Behavioral task
behavioral3
Sample
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe
Resource
win10-en-20211104
Behavioral task
behavioral5
Sample
14a3e308c90183b3785b6c26ec40d29405361cd8dec204a62235733401bf5f5c.exe
Resource
win7-en-20211014
Behavioral task
behavioral6
Sample
14a3e308c90183b3785b6c26ec40d29405361cd8dec204a62235733401bf5f5c.exe
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
1eea3cbd729d4493c0c0a84efe6840abf1760efe221dc971d32ca5017b5c19c2.exe
Resource
win7-en-20211104
Behavioral task
behavioral10
Sample
1eea3cbd729d4493c0c0a84efe6840abf1760efe221dc971d32ca5017b5c19c2.exe
Resource
win10-en-20211014
Behavioral task
behavioral11
Sample
20742987e6f743814b25e214f8b2cd43111e2f60a8856a6cca87cafd85422f41.exe
Resource
win7-en-20211104
Behavioral task
behavioral12
Sample
20742987e6f743814b25e214f8b2cd43111e2f60a8856a6cca87cafd85422f41.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
win10-en-20211104
Behavioral task
behavioral15
Sample
2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c.exe
Resource
win7-en-20211014
Behavioral task
behavioral16
Sample
2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c.exe
Resource
win10-en-20211104
Behavioral task
behavioral17
Sample
2aad85dbd4c79bd21c6218892552d5c9fb216293a251559ba59d45d56a01437c.exe
Resource
win7-en-20211014
Behavioral task
behavioral18
Sample
2aad85dbd4c79bd21c6218892552d5c9fb216293a251559ba59d45d56a01437c.exe
Resource
win10-en-20211104
Behavioral task
behavioral19
Sample
2c323453e959257c7aa86dc180bb3aaaa5c5ec06fa4e72b632d9e4b817052009.exe
Resource
win7-en-20211014
Behavioral task
behavioral20
Sample
2c323453e959257c7aa86dc180bb3aaaa5c5ec06fa4e72b632d9e4b817052009.exe
Resource
win10-en-20211104
Behavioral task
behavioral21
Sample
2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe
Resource
win7-en-20211104
Behavioral task
behavioral22
Sample
2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe
Resource
win10-en-20211014
Behavioral task
behavioral23
Sample
2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Resource
win7-en-20211104
Behavioral task
behavioral24
Sample
2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Resource
win10-en-20211014
Behavioral task
behavioral25
Sample
3a03530c732ebe53cdd7c17bee0988896d36c2b632dbd6118613697c2af82117.exe
Resource
win7-en-20211104
Behavioral task
behavioral26
Sample
3a03530c732ebe53cdd7c17bee0988896d36c2b632dbd6118613697c2af82117.exe
Resource
win10-en-20211014
Behavioral task
behavioral27
Sample
3a4bd5288b89aa26fbe39353b93c1205efa671be4f96e50beae0965f45fdcc40.exe
Resource
win7-en-20211104
Behavioral task
behavioral28
Sample
3a4bd5288b89aa26fbe39353b93c1205efa671be4f96e50beae0965f45fdcc40.exe
Resource
win10-en-20211014
Behavioral task
behavioral29
Sample
4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll
Resource
win7-en-20211104
Behavioral task
behavioral30
Sample
4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll
Resource
win10-en-20211104
Behavioral task
behavioral31
Sample
4be85e2083b64838fb66b92195a250228a721cdb5ae91817ea97b37aa53f4a2b.exe
Resource
win7-en-20211014
Behavioral task
behavioral32
Sample
4be85e2083b64838fb66b92195a250228a721cdb5ae91817ea97b37aa53f4a2b.exe
Resource
win10-en-20211104
General
-
Target
blackmatter.zip
-
Size
10.8MB
-
MD5
e1f207575fc9231e6ab7dbe2a7f55d5b
-
SHA1
3f701a77482c54c811c661dc21520e166769c511
-
SHA256
bf9511517f610387d714553bed6ff59d55c21cd0aa18ae00714585e699a332a3
-
SHA512
5a8717cfe195056d89f40d4be7b2c9a4bb85df763667a342545855366f58b7f5d627f6ed44ed380fdcf7440f569ff4f4f8a129ee41da0673bcba2b5570fe8c56
Malware Config
Extracted
blackmatter
1.2
512478c08dada2af19e49808fbda5b0b
- Username:
[email protected] - Password:
120Heisler
- Username:
[email protected] - Password:
Tesla2019
- Username:
[email protected] - Password:
iteam8**
https://paymenthacks.com
http://paymenthacks.com
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
14a875a2bd63041b2b3e5c323e8d5eee
- Username:
[email protected] - Password:
Voyager1701!!!
- Username:
[email protected] - Password:
HereGoes321
- Username:
[email protected] - Password:
QApassw0rd
- Username:
[email protected] - Password:
Aug21!!!
- Username:
[email protected] - Password:
Glasgow0315
- Username:
[email protected] - Password:
Eleanor22
- Username:
[email protected] - Password:
Glasgow0315
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
1.2
bab21ee475b52c0c9eb47d23ec9ba1d1
https://paymenthacks.com
http://paymenthacks.com
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
b368c1ee6bca2086d8169628466c0d3b
-
attempt_auth
false
-
create_mutex
false
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
2.0
04bdf8557fa74ea0e3adbd2975efd274
mepocs
memtas
veeam
svc$
backup
sql
vss
msexchange
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
5791ae39aeab40b5e8e33d8dce465877
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
1.9
28cc82fd466e0d0976a6359f264775a8
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
207aab0afc614ac68359fc63f9665961
https://fluentzip.org
http://fluentzip.org
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
6bed8cf959f0a07170c24bb972efd726
- Username:
Administrator@rpi - Password:
P0w3rPl4g
- Username:
2fatest@rpi - Password:
poiu-0987
- Username:
2fauser@rpi - Password:
1strongpassword!
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
e4aaffc36f5d5b7d597455eb6d497df5
- Username:
[email protected] - Password:
BBis#1ec
- Username:
[email protected] - Password:
k8DbBSZYWWnr0QqrILoo
- Username:
[email protected] - Password:
Smokie@CF
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
b0e039b42ef6c19c2189651c9f6c390e
- Username:
[email protected] - Password:
Rubcabher96
- Username:
[email protected] - Password:
Alsa2003
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
2.0
24483508bccfe72e63b26a1233058170
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
d58b3b69acc48f82eaa82076f97763d4
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
64139b5d8a3f06921a9364c262989e1f
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
1.6.0.2
bab21ee475b52c0c9eb47d23ec9ba1d1
http://paymenthacks.com
http://mojobiden.com
Extracted
blackmatter
1.6
32bd08ad5e5e881aa2634621d611a1a5
- Username:
[email protected] - Password:
@iep.2013
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
true
-
create_mutex
false
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
90a881ffa127b004cec6802588fce307
- Username:
[email protected] - Password:
Q7Q"
- Username:
[email protected] - Password:
!$(AYw94+PJ,rX
- Username:
jmiklo@@adroot.newcoop.com - Password:
sanfran85
- Username:
[email protected] - Password:
sanfran85
- Username:
[email protected] - Password:
sanfran85
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
3e8e2ab5fbb392508535983b7446ba17
https://fluentzip.org
http://fluentzip.org
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
1.6
0c6ca0532355a106258791f50b66c153
-
attempt_auth
false
-
create_mutex
false
-
encrypt_network_shares
false
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
2.0
09c87c28bed23dbe6ff5aa561d38766b
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
2.0
506d1d0f4ed51ecc3e9cf1839a4b21a7
-
attempt_auth
false
-
create_mutex
false
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
3.0
4e591a315c54e8800dae714320555fa5
- Username:
[email protected] - Password:
yhU6VJ$&
- Username:
[email protected] - Password:
RPo@ndf9
- Username:
[email protected] - Password:
DH5U87@rA0ELa2
https://fluentzip.org
http://fluentzip.org
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
d73c69209fbe768d5fa7ffbcad509c66
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
879194e26a0ed7cf50f13c681e711c82
- Username:
[email protected] - Password:
vpnvpn08
- Username:
[email protected] - Password:
Apr@123456
- Username:
[email protected] - Password:
Olympus$12345
- Username:
[email protected] - Password:
Olympus@12345
- Username:
[email protected] - Password:
ofrt!n@
- Username:
[email protected] - Password:
Is3@dmin
- Username:
[email protected] - Password:
Sinchan@12345
- Username:
[email protected] - Password:
HappyDays.12
- Username:
[email protected] - Password:
Qwerasdzx123!@#
- Username:
[email protected] - Password:
Coro@12345
- Username:
[email protected] - Password:
Ultimate06!
- Username:
[email protected] - Password:
Olympus@12345
- Username:
[email protected] - Password:
Zxcasd@123
- Username:
[email protected] - Password:
Qweasdzxc@12345
- Username:
[email protected] - Password:
Helmi-2005
- Username:
[email protected] - Password:
Acr0$$@123
- Username:
[email protected] - Password:
V1rtu@1c3!
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
1.6.0.4
b0e039b42ef6c19c2189651c9f6c390e
http://mojobiden.com
http://nowautomation.com
Extracted
blackmatter
2.0
10d51524bc007aa845e77556cdcab174
- Username:
[email protected] - Password:
tGv7R79N9rC@Y$RfLCkwb*byl*mxLv
- Username:
[email protected] - Password:
V3D174taC8Zb0EIz^cysiARR&
- Username:
[email protected] - Password:
YmedEwW&
- Username:
[email protected] - Password:
exiAClEU!wcrEi0R7szO087oH0h13B
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
6e46d36711d8be390c2b8121017ab146
mepocs
memtas
veeam
svc$
backup
sql
vss
msexchange
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
1.2
Extracted
blackmatter
2.0
5ecf7b9cde33f85a3eec9350275b5c4f
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
d0e84579a05c8e92e95eee8f5d0000e5
- Username:
[email protected] - Password:
Mouseman02
https://fluentzip.org
http://fluentzip.org
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Signatures
-
Blackmatter family
-
resource yara_rule static1/unpack001/072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486 upx static1/unpack001/668a4a2300f36c9df0f7307cc614be3297f036fa312a424765cdb2c169187fe6 upx static1/unpack001/eafce6e79a087b26475260afe43f337e7168056616b3e073832891bf18c299c1 upx -
resource yara_rule static1/unpack001/8323fdfda08300c691d330badec2607ea050cc10ee39934faeebedf3877df3ac vmprotect -
NSIS installer 2 IoCs
resource yara_rule static1/unpack001/cf60d0d6b05bfe2e51ca9dac01a4ae506b90d78d8d9d0fc266e3c01d8d2ba6b7 nsis_installer_1 static1/unpack001/cf60d0d6b05bfe2e51ca9dac01a4ae506b90d78d8d9d0fc266e3c01d8d2ba6b7 nsis_installer_2
Files
-
blackmatter.zip.zip
-
02ec55a8f4f97a84370ca72b03912ae8625d344b7bd1af92a2de4b636183f2ab.zip
Password: infected
-
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe windows x86
-
072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486.exe windows x86
-
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe windows x86
-
14a3e308c90183b3785b6c26ec40d29405361cd8dec204a62235733401bf5f5c.exe windows x86
-
1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.exe windows x86
-
1eea3cbd729d4493c0c0a84efe6840abf1760efe221dc971d32ca5017b5c19c2.exe windows x86
-
20742987e6f743814b25e214f8b2cd43111e2f60a8856a6cca87cafd85422f41.exe windows x86
-
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe windows x86
-
2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c.exe windows x86
-
2aad85dbd4c79bd21c6218892552d5c9fb216293a251559ba59d45d56a01437c.exe windows x86
-
2c323453e959257c7aa86dc180bb3aaaa5c5ec06fa4e72b632d9e4b817052009.exe windows x86
-
2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe windows x86
-
2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe windows x86
-
3a03530c732ebe53cdd7c17bee0988896d36c2b632dbd6118613697c2af82117.exe windows x86
-
3a4bd5288b89aa26fbe39353b93c1205efa671be4f96e50beae0965f45fdcc40.exe windows x86
-
4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll windows x86
-
4be85e2083b64838fb66b92195a250228a721cdb5ae91817ea97b37aa53f4a2b.exe windows x86
-
520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57.exe windows x86
-
5da8d2e1b36be0d661d276ea6523760dbe3fa4f3fdb7e32b144812ce50c483fa.exe windows x86
-
668a4a2300f36c9df0f7307cc614be3297f036fa312a424765cdb2c169187fe6.exe windows x86
-
66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe windows x86
-
6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502.elf linux x64
-
6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe windows x86
-
706f3eec328e91ff7f66c8f0a2fb9b556325c153a329a2062dc85879c540839d.exe windows x86
-
730f2d6243055c786d737bae0665267b962c64f57132e9ab401d6e7625c3d0a4.exe windows x86
-
77340f01535db5c80c1f3e725a8f8de17bb227f567b8f568dd339be6ddacf60e.exe windows x86
Exports
Exports
-
7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984.exe windows x86
-
8323fdfda08300c691d330badec2607ea050cc10ee39934faeebedf3877df3ac.exe windows x86
-
86c84c07e27cc8aba129e1cf51215b65c445f178b94f2e8c4c10e6bc110daa94.dll windows x86
-
8eada5114fbbc73b7d648b38623fc206367c94c0e76cb3b395a33ea8859d2952.exe windows x86
-
8f1b0affffb2f2f58b477515d1ce54f4daa40a761d828041603d5536c2d53539.exe windows x86
-
9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe windows x86
-
9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a.exe windows x86
-
b0e929e35c47a60f65e4420389cad46190c26e8cfaabe922efd73747b682776a.exe windows x86
-
b3e82b43750c7d0833f69abd3d31751c9e8face5063573946f61abbdda513eb8.exe windows x86
-
b4b9fdf30c017af1a8a3375218e43073117690a71c3f00ac5f6361993471e5e7.exe windows x86
-
b824bbc645f15e213b4cb2628f7d383e9e37282059b03f6fe60f7c84ea1fed1f.exe windows x86
-
bmhashes.txt
-
c6e2ef30a86baa670590bd21acf5b91822117e0cbe6060060bc5fe0182dace99.exe windows x86
-
c728e3a0d4a293e44314d663945354427848c220d05d5d87cdedd9995fee3dfe.dll windows x86
-
cf60d0d6b05bfe2e51ca9dac01a4ae506b90d78d8d9d0fc266e3c01d8d2ba6b7.exe windows x86
-
d4645d2c29505cf10d1b201826c777b62cbf9d752cb1008bef1192e0dd545a82.elf linux x64
-
d4647619fa2dc8fef5560d1662cbee6eb7dc95298dd40edf12dd4c8ee902d767.exe windows x86
-
daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe windows x86
-
e4a2260bcba8059207fdcc2d59841a8c4ddbe39b6b835feef671bceb95cd232d.exe windows x86
-
e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe windows x86
-
eaac447d6ae733210a07b1f79e97eda017a442e721d8fafe618e2c789b18234b.exe windows x86
-
eafce6e79a087b26475260afe43f337e7168056616b3e073832891bf18c299c1.exe windows x86
-
ed47e6ecca056bba20f2b299b9df1022caf2f3e7af1f526c1fe3b8bf2d6e7404.exe windows x86
-
f32604fba766c946b429cf7e152273794ebba9935999986b7e137ca46cd165fc.exe windows x86
-
f7b3da61cb6a37569270554776dbbd1406d7203718c0419c922aa393c07e9884.exe windows x86
-
fe2b2beeff98cae90f58a5b2f01dab31eaa98d274757a7dd9f70f4dc8432a6e2.exe windows x86