Static task
static1
Behavioral task
behavioral1
Sample
a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe
Resource
win10-en-20211208
General
-
Target
a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb
-
Size
96KB
-
MD5
d7f93757123c79564b540e59ed188974
-
SHA1
723e3879bae0772badef7b058db64dc947a5d8ba
-
SHA256
a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb
-
SHA512
13ca67a8ba4286cc00d8e57deadf39b0de49f8829f28ac13893eb094664c94586d5772da675d016f4d6041927163433b58a93c97babc9ddb5e44b8dbf735db8f
-
SSDEEP
1536:8nICS4ATxxZmvCzcHcvWOsTFpE36+X42N:7xZvfAn+
Malware Config
Extracted
blackmatter
2.0
e4aaffc36f5d5b7d597455eb6d497df5
- Username:
[email protected] - Password:
BBis#1ec
- Username:
[email protected] - Password:
k8DbBSZYWWnr0QqrILoo
- Username:
[email protected] - Password:
Smokie@CF
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Signatures
-
Blackmatter family
Files
-
a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe windows x86
2e4ae81fc349a1616df79a6f5499743f
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
SetPixel
SelectPalette
TextOutW
SelectObject
BitBlt
GetTextMetricsW
GetTextColor
CreateFontW
CreateDIBitmap
user32
GetMessageW
EndDialog
DefWindowProcW
CreateWindowExW
CreateMenu
kernel32
GetProcAddress
GetModuleHandleA
GetLocaleInfoW
GetCommandLineW
FormatMessageW
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ