General
-
Target
Payment CoPY.scr
-
Size
1.0MB
-
Sample
201205-r458s5ycpx
-
MD5
5687fc521f3ccd7d3176d9ed2daef426
-
SHA1
34c91e6ddf19a70417c0c140de3ec159873becc4
-
SHA256
bc64ddf551da94841af6b93a14a69de12ddeae5ba720fea5c4bf8ff95a14ada1
-
SHA512
4e3a384df767ec9235d856eeec03ac6746eabd098fc0b7b66708a4b233591a8814187f0815fb4192295793aab5d484e66b85a72fc85462fa2006cc7f3f620024
Static task
static1
Behavioral task
behavioral1
Sample
Payment CoPY.scr
Resource
win7v20201028
Malware Config
Extracted
Protocol: ftp- Host:
ftp.manmodesign-trade.com - Port:
21 - Username:
try@manmodesign-trade.com - Password:
MMother189
Extracted
matiex
Protocol: ftp- Host:
ftp://ftp.manmodesign-trade.com/ - Port:
21 - Username:
try@manmodesign-trade.com - Password:
MMother189
Targets
-
-
Target
Payment CoPY.scr
-
Size
1.0MB
-
MD5
5687fc521f3ccd7d3176d9ed2daef426
-
SHA1
34c91e6ddf19a70417c0c140de3ec159873becc4
-
SHA256
bc64ddf551da94841af6b93a14a69de12ddeae5ba720fea5c4bf8ff95a14ada1
-
SHA512
4e3a384df767ec9235d856eeec03ac6746eabd098fc0b7b66708a4b233591a8814187f0815fb4192295793aab5d484e66b85a72fc85462fa2006cc7f3f620024
-
Matiex Main Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-