General
-
Target
05a2116ecfc9309b34006fabff6d40d4.exe
-
Size
990KB
-
Sample
201117-vecc2aamfj
-
MD5
05a2116ecfc9309b34006fabff6d40d4
-
SHA1
63bcad12e9cd7805c11061d5f59fdffba1bc88b0
-
SHA256
682257a6e10dab11aefd8ab37dbe84de4537eaf592e3b3b13240098241cdd5aa
-
SHA512
fe0103dac5f3c7dd931534ef3e4ae3d866fb5d118b3a2b7e0c9d1ffc97618b61c26e4030e3fd6d250914bc3ccd0ba227717aad7e97172ffe0da1790ab345a541
Static task
static1
Behavioral task
behavioral1
Sample
05a2116ecfc9309b34006fabff6d40d4.exe
Resource
win7v20201028
Malware Config
Extracted
matiex
https://api.telegram.org/bot1474029845:AAESF02q0JZytndFFaKINAGOHrylDk8NpJA/sendMessage?chat_id=1481651786
Targets
-
-
Target
05a2116ecfc9309b34006fabff6d40d4.exe
-
Size
990KB
-
MD5
05a2116ecfc9309b34006fabff6d40d4
-
SHA1
63bcad12e9cd7805c11061d5f59fdffba1bc88b0
-
SHA256
682257a6e10dab11aefd8ab37dbe84de4537eaf592e3b3b13240098241cdd5aa
-
SHA512
fe0103dac5f3c7dd931534ef3e4ae3d866fb5d118b3a2b7e0c9d1ffc97618b61c26e4030e3fd6d250914bc3ccd0ba227717aad7e97172ffe0da1790ab345a541
-
Matiex Main Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-