Overview

overview

10

Static

static

10

0751c42296...a4.exe

windows7-x64

10

0751c42296...a4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2cb8565c23b7c833776a89e66cc0668024a8802799c349a31931221a54c73d2e

  • Size

    44KB

  • MD5

    33fd1eff1384b58c7bc81c0a5b703435

  • SHA1

    18b161012aa788b9bbcd86d321c3ad09ac15c278

  • SHA256

    2cb8565c23b7c833776a89e66cc0668024a8802799c349a31931221a54c73d2e

  • SHA512

    28f1d238a70deb3f6267da00e2b13edba495da7a6ddcadf421a4846b64e902bf1dee047f563941f140da7dc4c3e89f8ad12c674c80532a4fccbdf379b21eae63

  • SSDEEP

    768:1vVXmla561N4HJiYyTl6g+lEeDkuw+k4cHkYoxK8VB2GcBponS3heolNXWJWLc7O:1vV0a+eHJwl6pIuwvEYoo8xcBp5x+Wwa

Score
10/10
14a875a2bd63041b2b3e5c323e8d5eeeblackmatter

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

14a875a2bd63041b2b3e5c323e8d5eee

Credentials
C2

https://mojobiden.com

http://mojobiden.com

https://nowautomation.com

http://nowautomation.com
Attributes
  • attempt_auth

    true

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Signatures

  • Blackmatter family
    blackmatter
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2cb8565c23b7c833776a89e66cc0668024a8802799c349a31931221a54c73d2e
    .zip

    Password: infected

  • 0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4
    .exe windows:5 windows x86 arch:x86

    2e4ae81fc349a1616df79a6f5499743f


    Headers

    Imports

    Sections