General
-
Target
NKP210102-NIT-SC2.exe
-
Size
779KB
-
Sample
210114-3g7t49t7na
-
MD5
087dfca6f2b2c9825a49d4b986d7f539
-
SHA1
748e44b93cf2882248b2e27c728eb11018984bf4
-
SHA256
af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7
-
SHA512
25ab703c8261e1c36e4656b405b2aff6c8595bc26fe3b0f982e7249a90d6d6405d5f66ff8c28f8696d16c99a479718657dc669e0e4e5c2abe00e3ea03bac588d
Static task
static1
Behavioral task
behavioral1
Sample
NKP210102-NIT-SC2.exe
Resource
win7v20201028
Malware Config
Extracted
Protocol: smtp- Host:
mail.revistaeducar.com.ar - Port:
25 - Username:
smtp-1a2c5@revistaeducar.com.ar - Password:
somchai#3774
Extracted
matiex
Protocol: smtp- Host:
mail.revistaeducar.com.ar - Port:
25 - Username:
smtp-1a2c5@revistaeducar.com.ar - Password:
somchai#3774
Targets
-
-
Target
NKP210102-NIT-SC2.exe
-
Size
779KB
-
MD5
087dfca6f2b2c9825a49d4b986d7f539
-
SHA1
748e44b93cf2882248b2e27c728eb11018984bf4
-
SHA256
af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7
-
SHA512
25ab703c8261e1c36e4656b405b2aff6c8595bc26fe3b0f982e7249a90d6d6405d5f66ff8c28f8696d16c99a479718657dc669e0e4e5c2abe00e3ea03bac588d
-
Matiex Main Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-