Overview

overview

10

Static

static

10

2e50eb85f6...b2.exe

windows7-x64

10

2e50eb85f6...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.zip

  • Size

    41KB

  • MD5

    f57a2e95937e7727c82b0782e1cdd0d0

  • SHA1

    570ac30c3c40c62d67ac39e857e840b69908ed16

  • SHA256

    e038bb439a412f1c98d22a9a4726fbe0747a8bbbb48a8d26ac4dcb039f29e53e

  • SHA512

    be171554a26d962445b8a9238abc6faecd2398dc04305730ef44f03418f20971657254f04887c4dbbca87d0a360077cb9e4666747882ba4bdc82e8d567858647

  • SSDEEP

    768:3NcvHcsURlton9qGtNp2lpM7/FyJhbG72vkT7gxs2Kee19Z5zlznX3T:9cvHajoncaN4rEE672MT7d3zZ59nHT

Score
10/10
e4aaffc36f5d5b7d597455eb6d497df5blackmatter

Malware Config

Extracted

Family

blackmatter

Version

2.0

Botnet

e4aaffc36f5d5b7d597455eb6d497df5

Credentials
C2

https://mojobiden.com

http://mojobiden.com

https://nowautomation.com

http://nowautomation.com
Attributes
  • attempt_auth

    true

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Signatures

  • Blackmatter family
    blackmatter
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.zip
    .zip

    Password: infected

  • 2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
    .exe windows:5 windows x86 arch:x86

    2e4ae81fc349a1616df79a6f5499743f


    Headers

    Imports

    Sections