General
-
Target
blackmatter4.zip
-
Size
703KB
-
MD5
e5416e33cbe4b3b63ff0f741bf468622
-
SHA1
e82597ae9f87b1568d7cbd966a0185a24f1a108c
-
SHA256
8561226f674aeb4abc1b9910ddc4855ac8ac2fcd4f5face1f84e34878ac98afc
-
SHA512
95acf78b3a4092e06f08d12a05a7fbe209ddda7beff0be6fb071b11f272ab84c18ed9e22adb5b046636f1d895dad17c29650868093aa11c6f7733cfbdee4141b
Malware Config
Extracted
blackmatter
2.0
5791ae39aeab40b5e8e33d8dce465877
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
1.2
512478c08dada2af19e49808fbda5b0b
- Username:
[email protected] - Password:
120Heisler
- Username:
[email protected] - Password:
Tesla2019
- Username:
[email protected] - Password:
iteam8**
https://paymenthacks.com
http://paymenthacks.com
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
1.2
bab21ee475b52c0c9eb47d23ec9ba1d1
https://paymenthacks.com
http://paymenthacks.com
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
e4aaffc36f5d5b7d597455eb6d497df5
- Username:
[email protected] - Password:
BBis#1ec
- Username:
[email protected] - Password:
k8DbBSZYWWnr0QqrILoo
- Username:
[email protected] - Password:
Smokie@CF
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
b0e039b42ef6c19c2189651c9f6c390e
- Username:
[email protected] - Password:
Rubcabher96
- Username:
[email protected] - Password:
Alsa2003
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
2.0
d58b3b69acc48f82eaa82076f97763d4
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
1.6
32bd08ad5e5e881aa2634621d611a1a5
- Username:
[email protected] - Password:
@iep.2013
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
true
-
create_mutex
false
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
90a881ffa127b004cec6802588fce307
- Username:
[email protected] - Password:
Q7Q"
- Username:
[email protected] - Password:
!$(AYw94+PJ,rX
- Username:
jmiklo@@adroot.newcoop.com - Password:
sanfran85
- Username:
[email protected] - Password:
sanfran85
- Username:
[email protected] - Password:
sanfran85
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
d73c69209fbe768d5fa7ffbcad509c66
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
2.0
879194e26a0ed7cf50f13c681e711c82
- Username:
[email protected] - Password:
vpnvpn08
- Username:
[email protected] - Password:
Apr@123456
- Username:
[email protected] - Password:
Olympus$12345
- Username:
[email protected] - Password:
Olympus@12345
- Username:
[email protected] - Password:
ofrt!n@
- Username:
[email protected] - Password:
Is3@dmin
- Username:
[email protected] - Password:
Sinchan@12345
- Username:
[email protected] - Password:
HappyDays.12
- Username:
[email protected] - Password:
Qwerasdzx123!@#
- Username:
[email protected] - Password:
Coro@12345
- Username:
[email protected] - Password:
Ultimate06!
- Username:
[email protected] - Password:
Olympus@12345
- Username:
[email protected] - Password:
Zxcasd@123
- Username:
[email protected] - Password:
Qweasdzxc@12345
- Username:
[email protected] - Password:
Helmi-2005
- Username:
[email protected] - Password:
Acr0$$@123
- Username:
[email protected] - Password:
V1rtu@1c3!
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Extracted
blackmatter
2.0
10d51524bc007aa845e77556cdcab174
- Username:
[email protected] - Password:
tGv7R79N9rC@Y$RfLCkwb*byl*mxLv
- Username:
[email protected] - Password:
V3D174taC8Zb0EIz^cysiARR&
- Username:
[email protected] - Password:
YmedEwW&
- Username:
[email protected] - Password:
exiAClEU!wcrEi0R7szO087oH0h13B
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
blackmatter
1.2
Signatures
-
Blackmatter family
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Files
-
blackmatter4.zip
-
072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486
-
20742987e6f743814b25e214f8b2cd43111e2f60a8856a6cca87cafd85422f41
-
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6
-
2c323453e959257c7aa86dc180bb3aaaa5c5ec06fa4e72b632d9e4b817052009
-
2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2
-
4be85e2083b64838fb66b92195a250228a721cdb5ae91817ea97b37aa53f4a2b
-
5da8d2e1b36be0d661d276ea6523760dbe3fa4f3fdb7e32b144812ce50c483fa
-
668a4a2300f36c9df0f7307cc614be3297f036fa312a424765cdb2c169187fe6
-
6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db
-
706f3eec328e91ff7f66c8f0a2fb9b556325c153a329a2062dc85879c540839d
-
7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984
-
9cf9441554ac727f9d191ad9de1dc101867ffe5264699cafcf2734a4b89d5d6a
-
b0e929e35c47a60f65e4420389cad46190c26e8cfaabe922efd73747b682776a
-
c6e2ef30a86baa670590bd21acf5b91822117e0cbe6060060bc5fe0182dace99
-
e4a2260bcba8059207fdcc2d59841a8c4ddbe39b6b835feef671bceb95cd232d
-
eaac447d6ae733210a07b1f79e97eda017a442e721d8fafe618e2c789b18234b
-
eafce6e79a087b26475260afe43f337e7168056616b3e073832891bf18c299c1
-
f32604fba766c946b429cf7e152273794ebba9935999986b7e137ca46cd165fc