blackmatter | 706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D[.]7z

Resubmissions

25/03/2025, 13:19

250325-qkkrrszps510

05/02/2025, 11:22

250205-ngk71strbx10

25/06/2024, 15:43

240625-s6cz6a1gnj10

25/06/2024, 15:17

240625-sn4p6axdma10

Sharing

Copy URL Twitter E-mail

General

Target
706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D.7z
Size 33KB
Sample250205-ngk71strbx
SHA256 c644cbce9a802252e9021e43959a90015538f3e8e40cbe87a518b9458389c4a8
MD5 6611740b5be8acf02c30c78a0feec0a3
SHA1 458d4fbd8452785c729a1e41cdf434c40afcc86b
SHA512 299f9aa4cc44b8fd541a3479edea9b809ecbe29b2d4402cb602791461976ab0fa2d1c40a715e2e124d07a930ce775747ae287ca8c29a3b01e7345a48548f01be
SSDEEP 768:hH1DRycS4DIPj45eT5vDwu7FH9AdnwIn86p11xw8oPGh60F36Im:DRF7DIPMavnRH9AFwI511x+yKIm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

90a881ffa127b004cec6802588fce307 blackmatter

Malware Config

Extracted

Family

blackmatter

Version

Botnet

90a881ffa127b004cec6802588fce307

Credentials

Username
[email protected]
Password
Q7Q&quot

Credentials

Username
[email protected]
Password
!$(AYw94+PJ,rX

Credentials

Username
jmiklo@@adroot.newcoop.com
Password
sanfran85

Credentials

Username
[email protected]
Password
sanfran85

Credentials

Username
[email protected]
Password
sanfran85

https://mojobiden.com
http://mojobiden.com
https://nowautomation.com
http://nowautomation.com

Attributes

attempt_auth
true
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true

rsa_pubkey.base64

aes.base64

Signatures

Blackmatter family
blackmatter

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D

File Explorer

706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D.7z

.7z 33KB
706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D

.exe 79KB

706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D.7z

SHA256 c644cbce9a802252e9021e43959a90015538f3e8e40cbe87a518b9458389c4a8
MD5 6611740b5be8acf02c30c78a0feec0a3
SHA1 458d4fbd8452785c729a1e41cdf434c40afcc86b
SHA512 299f9aa4cc44b8fd541a3479edea9b809ecbe29b2d4402cb602791461976ab0fa2d1c40a715e2e124d07a930ce775747ae287ca8c29a3b01e7345a48548f01be
SSDEEP 768:hH1DRycS4DIPj45eT5vDwu7FH9AdnwIn86p11xw8oPGh60F36Im:DRF7DIPMavnRH9AFwI511x+yKIm
MD5 SHA1 SHA512 SSDEEP

Password

infected

706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D

IMPHASH 2e4ae81fc349a1616df79a6f5499743f
SHA256 706f3eec328e91ff7f66c8f0a2fb9b556325c153a329a2062dc85879c540839d
MD5 62a1b4d4b461f4eaae91c70727f71604
SHA1 1ced9a7e62aa65faa03eb1ad2bc786e9d9b5f6c2
SHA512 d14f989f5f54663c3ea63526a000e8db5d172046e37f412ed47cd31eb14db071b515b854bbb3ab3d2f41f936b6962583aaa0b3ef1236aa2506148813f66ad542
SSDEEP 1536:DnICS4ArFnRoHhcVyid9EZZoi+zQ95f8IwdON:QZnmqVyq9EN+M95bwE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

71033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D.7z

706F3EEC328E91FF7F66C8F0A2FB9B556325C153A329A2062DC85879C540839D

gdi32

user32

kernel32

generic