General
-
Target
Order list.exe
-
Size
656KB
-
Sample
201217-69cf2wbc3a
-
MD5
484ba011bd0b7a3c549f7f0b67820533
-
SHA1
c539373e7fa68338683d055558830f6d97738932
-
SHA256
413081e822500ceec0508640a488c77ac68960e76ca31257ba1ba2d1d536d2eb
-
SHA512
798bda73de87a0705a33023bee8bc10b6514509b2942a9de505287da011022c46b59f99838a913142f2c92d31e0bc80d9b9c40f6edd664f47e1e75dffd277c63
Static task
static1
Behavioral task
behavioral1
Sample
Order list.exe
Resource
win7v20201028
Malware Config
Extracted
matiex
https://api.telegram.org/bot1474029845:AAESF02q0JZytndFFaKINAGOHrylDk8NpJA/sendMessage?chat_id=1481651786
Targets
-
-
Target
Order list.exe
-
Size
656KB
-
MD5
484ba011bd0b7a3c549f7f0b67820533
-
SHA1
c539373e7fa68338683d055558830f6d97738932
-
SHA256
413081e822500ceec0508640a488c77ac68960e76ca31257ba1ba2d1d536d2eb
-
SHA512
798bda73de87a0705a33023bee8bc10b6514509b2942a9de505287da011022c46b59f99838a913142f2c92d31e0bc80d9b9c40f6edd664f47e1e75dffd277c63
-
Matiex Main Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-