Overview

overview

10

Static

static

10

22d7d67c3a...d6.exe

windows10-2004-x64

10

22d7d67c3a...d6.exe

windows11-21h2-x64

22d7d67c3a...d6.exe

android-9-x86

22d7d67c3a...d6.exe

macos-10.15-amd64

1

22d7d67c3a...d6.exe

debian-9-mipsel

22d7d67c3a...d6.exe

ubuntu-18.04-amd64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.zip

  • Size

    38KB

  • MD5

    286ca2c13c495df13d3b82474734352b

  • SHA1

    12c98b130565cfd7d26e59b21467f6a161cc7521

  • SHA256

    3ed7c84e02085f4a019e047a4bcae4ac3c1b002f08bc7b22a4db3e4c948d9538

  • SHA512

    0d96f9fa26e23c89ca56d95cb107d0b09036c34f54315d96fd455ed0aeedb2b1e3cb1eebbf3c640ffbdea8cff244d465d35d8304b83c46044ee92a9884c4df78

  • SSDEEP

    768:3CdzU5U4KRVW6G97Yb2yMm/clB4n8oB7tLslepd9T7/F72:3CdzW+06G97Y6NmrjB7tLsMXd72

Score
10/10
512478c08dada2af19e49808fbda5b0bblackmatter

Malware Config

Extracted

Family

blackmatter

Version

1.2

Botnet

512478c08dada2af19e49808fbda5b0b

Credentials
  • Username:
    aheisler@hhcp.com
  • Password:
    120Heisler
  • Username:
    dsmith@hhcp.com
  • Password:
    Tesla2019
  • Username:
    administrator@hhcp.com
  • Password:
    iteam8**
C2

https://paymenthacks.com

http://paymenthacks.com

https://mojobiden.com

http://mojobiden.com
Attributes
  • attempt_auth

    true

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Signatures

Files

  • 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.zip
    .zip

    Password: infected

  • 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
    .exe windows x86

    Password: infected

    c94b1566bf307396953c849ef18f9857


    Headers

    Imports

    Sections