General
-
Target
779d6bbd6896f4523271be6e37a115e0.exe
-
Size
2.1MB
-
Sample
201229-bgbvrxb5p6
-
MD5
779d6bbd6896f4523271be6e37a115e0
-
SHA1
7f85bc774b87ad220a6f8dd87ca8447631d44147
-
SHA256
95d6724114c72160be15e03a2280c5548ece04815f52f6d61666c23bc5551cfc
-
SHA512
e8c0a72a9c867f68ee079eba2e12482e68526c0d89546dd1377fd4c96b38b0079c2573511665e9ed28ca93b6d3dcd0595ce1476d4c215ccd753563a528292589
Static task
static1
Behavioral task
behavioral1
Sample
779d6bbd6896f4523271be6e37a115e0.exe
Resource
win7v20201028
Malware Config
Extracted
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
info@bilgitekdagitim.com - Password:
italik2015
Extracted
matiex
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
info@bilgitekdagitim.com - Password:
italik2015
Targets
-
-
Target
779d6bbd6896f4523271be6e37a115e0.exe
-
Size
2.1MB
-
MD5
779d6bbd6896f4523271be6e37a115e0
-
SHA1
7f85bc774b87ad220a6f8dd87ca8447631d44147
-
SHA256
95d6724114c72160be15e03a2280c5548ece04815f52f6d61666c23bc5551cfc
-
SHA512
e8c0a72a9c867f68ee079eba2e12482e68526c0d89546dd1377fd4c96b38b0079c2573511665e9ed28ca93b6d3dcd0595ce1476d4c215ccd753563a528292589
-
Matiex Main Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-