General
-
Target
292aee5526ba2e4858d7ea9178878387.exe
-
Size
832KB
-
Sample
211016-xlyhkscbh4
-
MD5
292aee5526ba2e4858d7ea9178878387
-
SHA1
305c62f106a105f086b3a9ad40a2e706d843a148
-
SHA256
cb3a930b00d73a9d5a0313b549a93636eecaf9a4c370e2e9d9ca1b1eaf302eff
-
SHA512
b1c3adc4b4960b0d77c596a1d800f027e49d4c1b2b14ba4a293741fd6118e10ead8ca5890e1c296dd711434bc029fa16f26768a0888edee15153a68ad6daad2b
Static task
static1
Behavioral task
behavioral1
Sample
292aee5526ba2e4858d7ea9178878387.exe
Resource
win7-en-20210920
Malware Config
Extracted
Protocol: smtp- Host:
mail.thts.vn - Port:
25 - Username:
[email protected] - Password:
123luongngan1989
Extracted
matiex
Protocol: smtp- Host:
mail.thts.vn - Port:
25 - Username:
[email protected] - Password:
123luongngan1989
Targets
-
-
Target
292aee5526ba2e4858d7ea9178878387.exe
-
Size
832KB
-
MD5
292aee5526ba2e4858d7ea9178878387
-
SHA1
305c62f106a105f086b3a9ad40a2e706d843a148
-
SHA256
cb3a930b00d73a9d5a0313b549a93636eecaf9a4c370e2e9d9ca1b1eaf302eff
-
SHA512
b1c3adc4b4960b0d77c596a1d800f027e49d4c1b2b14ba4a293741fd6118e10ead8ca5890e1c296dd711434bc029fa16f26768a0888edee15153a68ad6daad2b
-
Matiex Main Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-