General
-
Target
ORDER LIST.exe
-
Size
701KB
-
Sample
201214-rmnz37ap72
-
MD5
601153fa97c602f49c4e377eb1d38052
-
SHA1
8c19f692006151c303cb4d4d3dcdbe36c4a38e82
-
SHA256
a5b33a0140bd230159c87e3e86723e6f00cc19046b4d05bbc02336471a711e1c
-
SHA512
4f0cfe395b95456e0348a6d8376a802eeb308421372335cf416992ebf0d02519ab4f75470eb51f46a2c7d2282106682b09e47862b5602e813404f3cebf9c08b7
Static task
static1
Behavioral task
behavioral1
Sample
ORDER LIST.exe
Resource
win7v20201028
Malware Config
Extracted
matiex
https://api.telegram.org/bot1474029845:AAESF02q0JZytndFFaKINAGOHrylDk8NpJA/sendMessage?chat_id=1481651786
Targets
-
-
Target
ORDER LIST.exe
-
Size
701KB
-
MD5
601153fa97c602f49c4e377eb1d38052
-
SHA1
8c19f692006151c303cb4d4d3dcdbe36c4a38e82
-
SHA256
a5b33a0140bd230159c87e3e86723e6f00cc19046b4d05bbc02336471a711e1c
-
SHA512
4f0cfe395b95456e0348a6d8376a802eeb308421372335cf416992ebf0d02519ab4f75470eb51f46a2c7d2282106682b09e47862b5602e813404f3cebf9c08b7
-
Matiex Main Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-