General
-
Target
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.zip
-
Size
38KB
-
MD5
286ca2c13c495df13d3b82474734352b
-
SHA1
12c98b130565cfd7d26e59b21467f6a161cc7521
-
SHA256
3ed7c84e02085f4a019e047a4bcae4ac3c1b002f08bc7b22a4db3e4c948d9538
-
SHA512
0d96f9fa26e23c89ca56d95cb107d0b09036c34f54315d96fd455ed0aeedb2b1e3cb1eebbf3c640ffbdea8cff244d465d35d8304b83c46044ee92a9884c4df78
-
SSDEEP
768:3CdzU5U4KRVW6G97Yb2yMm/clB4n8oB7tLslepd9T7/F72:3CdzW+06G97Y6NmrjB7tLsMXd72
Score
10/10
Malware Config
Extracted
Family
blackmatter
Version
1.2
Botnet
512478c08dada2af19e49808fbda5b0b
Credentials
- Username:
[email protected] - Password:
120Heisler
- Username:
[email protected] - Password:
Tesla2019
- Username:
[email protected] - Password:
iteam8**
C2
https://paymenthacks.com
http://paymenthacks.com
https://mojobiden.com
http://mojobiden.com
Attributes
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
rsa_pubkey.base64
aes.base64
Signatures
-
Blackmatter family
Files
-
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.zip
Password: infected
-
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Password: infected
c94b1566bf307396953c849ef18f9857
Headers
Imports
Sections