General
-
Target
0908000090000.exe
-
Size
3.4MB
-
Sample
201230-t1ner46trs
-
MD5
2b16401ac7e40343abde78deb36f0746
-
SHA1
6c441249071a590f6a1178cc276f87f8641c8cf4
-
SHA256
315e6e844a325bdbdbd68365d389adb3e31c55cf7323936f14f3e48f7e5f3014
-
SHA512
3ec8ac63db7b07b9a43b37f27cc80da7543baab0c259e25de2e92cc058427b385d4dc6aa91fc12cdd3b1d6d40c20df1a5c7731ec750a91770f98631c1840a9b8
Static task
static1
Behavioral task
behavioral1
Sample
0908000090000.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0908000090000.exe
Resource
win10v20201028
Malware Config
Extracted
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
info@bilgitekdagitim.com - Password:
italik2015
Extracted
matiex
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
info@bilgitekdagitim.com - Password:
italik2015
Targets
-
-
Target
0908000090000.exe
-
Size
3.4MB
-
MD5
2b16401ac7e40343abde78deb36f0746
-
SHA1
6c441249071a590f6a1178cc276f87f8641c8cf4
-
SHA256
315e6e844a325bdbdbd68365d389adb3e31c55cf7323936f14f3e48f7e5f3014
-
SHA512
3ec8ac63db7b07b9a43b37f27cc80da7543baab0c259e25de2e92cc058427b385d4dc6aa91fc12cdd3b1d6d40c20df1a5c7731ec750a91770f98631c1840a9b8
Score10/10-
Matiex Main Payload
-
Modifies WinLogon for persistence
-
Drops startup file
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-