Overview

overview

10

Static

static

10

706f3eec32...9d.exe

windows7-x64

10

706f3eec32...9d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    201ad4b503f9b0bf629c8acbb9d9f9722cfecd0f0b889d95d4a25d3c8beff3b8

  • Size

    44KB

  • MD5

    2fce17c40025f1cc9167a77339face9b

  • SHA1

    bfb018973bd62dedd53ea1e26e442c214ed88dca

  • SHA256

    201ad4b503f9b0bf629c8acbb9d9f9722cfecd0f0b889d95d4a25d3c8beff3b8

  • SHA512

    087201fe4909e2a98fa808db8e9a13c981b6bd7de226bc0682e1e7983a7079a9c8ebd852ead235bc0410cb4d28c9ce5265d128bc8f35177dfa84990aa9a5c608

  • SSDEEP

    768:oZ/Ws8jZIJplJrBbFBNN3ibZzMI93NTwvJGdbMFM50IMruRiQ2CvFIly:oZes81IJjZBbCz93NTwMFA40IM6gQwM

Score
10/10
90a881ffa127b004cec6802588fce307blackmatter

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

90a881ffa127b004cec6802588fce307

Credentials
  • Username:
    jmiklo@@adroot.newcoop.com
  • Password:
    sanfran85
C2

https://mojobiden.com

http://mojobiden.com

https://nowautomation.com

http://nowautomation.com
Attributes
  • attempt_auth

    true

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Signatures

  • Blackmatter family
    blackmatter
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 201ad4b503f9b0bf629c8acbb9d9f9722cfecd0f0b889d95d4a25d3c8beff3b8
    .zip

    Password: infected

  • 706f3eec328e91ff7f66c8f0a2fb9b556325c153a329a2062dc85879c540839d
    .exe windows:5 windows x86 arch:x86

    2e4ae81fc349a1616df79a6f5499743f


    Headers

    Imports

    Sections