General
-
Target
706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D.7z
-
Size
33KB
-
MD5
6611740b5be8acf02c30c78a0feec0a3
-
SHA1
458d4fbd8452785c729a1e41cdf434c40afcc86b
-
SHA256
c644cbce9a802252e9021e43959a90015538f3e8e40cbe87a518b9458389c4a8
-
SHA512
299f9aa4cc44b8fd541a3479edea9b809ecbe29b2d4402cb602791461976ab0fa2d1c40a715e2e124d07a930ce775747ae287ca8c29a3b01e7345a48548f01be
-
SSDEEP
768:hH1DRycS4DIPj45eT5vDwu7FH9AdnwIn86p11xw8oPGh60F36Im:DRF7DIPMavnRH9AFwI511x+yKIm
Score
10/10
Malware Config
Extracted
Family
blackmatter
Version
2.0
Botnet
90a881ffa127b004cec6802588fce307
Credentials
- Username:
[email protected] - Password:
Q7Q"
- Username:
[email protected] - Password:
!$(AYw94+PJ,rX
- Username:
jmiklo@@adroot.newcoop.com - Password:
sanfran85
- Username:
[email protected] - Password:
sanfran85
- Username:
[email protected] - Password:
sanfran85
C2
https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com
Attributes
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
rsa_pubkey.base64
aes.base64
Signatures
-
Blackmatter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D.7z
Password: infected
-
706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D
Password: infected
2e4ae81fc349a1616df79a6f5499743f
Headers
Imports
Sections