General

  • Target

    6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502.zip

  • Size

    771KB

  • MD5

    94a385667474368533873ed38157d5e3

  • SHA1

    9aa5a233d716af510503c1c51451127db601a501

  • SHA256

    d701a12afd0283146465a10768abd1c88c059277d94884c3ed1e04ae03254ae5

  • SHA512

    f8d5e88792b4225f491745d62bf94a4644c12bba6890fbeffd5f581a282b7e84a6dc05fe9c0b1e132888bb7791aea023588b18393c2284f051dd88382e5d0627

  • SSDEEP

    12288:azsfk+Ykuwt5SA2tPxbJ+Yddne9igvSctejBZK/7JCWNGiGhPEWDLXoGXypx/:Qwt5wtPjjd4k2ejT2CWKtEWDjoGyl

Malware Config

Extracted

Family

blackmatter

Version

1.6.0.2

Botnet

bab21ee475b52c0c9eb47d23ec9ba1d1

C2

http://paymenthacks.com

http://mojobiden.com

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502.zip
    .zip

    Password: infected

  • Linux.Encryptor
    .elf linux x64