General
-
Target
e59ecfb5f8291dd2fdaba9cf0a8a31fe.exe
-
Size
1.4MB
-
Sample
201224-p4lv68cejn
-
MD5
e59ecfb5f8291dd2fdaba9cf0a8a31fe
-
SHA1
8381a768e0c92c2bde3c093a9fe8cd8b385e0f16
-
SHA256
eefd38a540e7ac67780dda6a05981f1c6c4933717adce549e060d098e7b0fb29
-
SHA512
07714065a40373247fc6454ef3a16c4c163179314f872e6a3318ae5660346cfd7bf58a24ea21d8cee8de7658288a0e299708bd17bd1e16f07361f3731a1fa313
Static task
static1
Behavioral task
behavioral1
Sample
e59ecfb5f8291dd2fdaba9cf0a8a31fe.exe
Resource
win7v20201028
Malware Config
Extracted
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
info@bilgitekdagitim.com - Password:
italik2015
Extracted
matiex
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
info@bilgitekdagitim.com - Password:
italik2015
Targets
-
-
Target
e59ecfb5f8291dd2fdaba9cf0a8a31fe.exe
-
Size
1.4MB
-
MD5
e59ecfb5f8291dd2fdaba9cf0a8a31fe
-
SHA1
8381a768e0c92c2bde3c093a9fe8cd8b385e0f16
-
SHA256
eefd38a540e7ac67780dda6a05981f1c6c4933717adce549e060d098e7b0fb29
-
SHA512
07714065a40373247fc6454ef3a16c4c163179314f872e6a3318ae5660346cfd7bf58a24ea21d8cee8de7658288a0e299708bd17bd1e16f07361f3731a1fa313
-
Matiex Main Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-