Overview

overview

10

Static

static

10

18c7c940bc...a8.exe

windows7-x64

10

18c7c940bc...a8.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18c7c940bc6a4e778fbdf4a3e28151a8

  • Size

    79KB

  • MD5

    18c7c940bc6a4e778fbdf4a3e28151a8

  • SHA1

    f3589918d71b87c7e764479b79c4a7b485cb746a

  • SHA256

    2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2

  • SHA512

    6e808fe882640a517c2054fdece73059c7ea3e27a946e55f41b91fd0f757dcd8c76be8f381f60f3e45449edebaa4f620b903337727607f7768543b1acec40d18

  • SSDEEP

    1536:+nICS4ArFnRoHhcVyid9EZZoi+zQXFpVX42N:5ZnmqVyq9EN+Mb7

Score
10/10
e4aaffc36f5d5b7d597455eb6d497df5blackmatter

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

e4aaffc36f5d5b7d597455eb6d497df5

Credentials
C2

https://mojobiden.com

http://mojobiden.com

https://nowautomation.com

http://nowautomation.com
Attributes
  • attempt_auth

    true

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Signatures

  • Blackmatter family
    blackmatter
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 18c7c940bc6a4e778fbdf4a3e28151a8
    .exe windows:5 windows x86 arch:x86

    2e4ae81fc349a1616df79a6f5499743f


    Headers

    Imports

    Sections