General
-
Target
NN0900087890.exe
-
Size
389KB
-
Sample
211005-pphyasaafq
-
MD5
2143f5e16ab1ccac518c5318607de780
-
SHA1
ae2f3ef507ff24582316fbe556d84d28f0c00331
-
SHA256
2a110d7e364ad29a87c03c0418154c360c3be3f473fe0434656908d954e6bdd3
-
SHA512
2ab401aae0437536bcb6cf8e1efbaa26179ef8aaf0a33ee3060858d6cb3ac45f5e13f056044a250d6f633aafa004eccf529f5a8831a5032db4dd5f981254e224
Static task
static1
Behavioral task
behavioral1
Sample
NN0900087890.exe
Resource
win7-en-20210920
Malware Config
Extracted
matiex
https://api.telegram.org/bot1395392888:AAFrJovDdZICOFB0gX0eGWrAUzEKCRpv8xo/sendMessage?chat_id=1300181783
Targets
-
-
Target
NN0900087890.exe
-
Size
389KB
-
MD5
2143f5e16ab1ccac518c5318607de780
-
SHA1
ae2f3ef507ff24582316fbe556d84d28f0c00331
-
SHA256
2a110d7e364ad29a87c03c0418154c360c3be3f473fe0434656908d954e6bdd3
-
SHA512
2ab401aae0437536bcb6cf8e1efbaa26179ef8aaf0a33ee3060858d6cb3ac45f5e13f056044a250d6f633aafa004eccf529f5a8831a5032db4dd5f981254e224
-
Matiex Main Payload
-
suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram
suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-