General
-
Target
ac52db0c62fac74e6708635ac3db5f46.exe
-
Size
343KB
-
Sample
211011-rlmheshdg6
-
MD5
ac52db0c62fac74e6708635ac3db5f46
-
SHA1
0f35104cb6938b60cabbaf6257975792d5399024
-
SHA256
cd4d29b138b75a9d1a10fa7d724168ae155ef7779d97c042e8014b9ae6f93087
-
SHA512
95953124e75a38ed27ad6e60cbe0f9e952d5d367237784a3c0b47ed7d5fa30846f61a575458e3880b8f0539924cfd029983aa46a137db5ff5152e82140df7925
Static task
static1
Behavioral task
behavioral1
Sample
ac52db0c62fac74e6708635ac3db5f46.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ac52db0c62fac74e6708635ac3db5f46.exe
Resource
win10-en-20210920
Malware Config
Extracted
matiex
https://api.telegram.org/bot1395392888:AAFrJovDdZICOFB0gX0eGWrAUzEKCRpv8xo/sendMessage?chat_id=1300181783
Targets
-
-
Target
ac52db0c62fac74e6708635ac3db5f46.exe
-
Size
343KB
-
MD5
ac52db0c62fac74e6708635ac3db5f46
-
SHA1
0f35104cb6938b60cabbaf6257975792d5399024
-
SHA256
cd4d29b138b75a9d1a10fa7d724168ae155ef7779d97c042e8014b9ae6f93087
-
SHA512
95953124e75a38ed27ad6e60cbe0f9e952d5d367237784a3c0b47ed7d5fa30846f61a575458e3880b8f0539924cfd029983aa46a137db5ff5152e82140df7925
Score10/10-
Matiex Main Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-