General
-
Target
40987654323456789098746789098765432345678.exe
-
Size
464KB
-
Sample
220128-zkwcyadee5
-
MD5
b9a4dbf6bb05c4fe97ba541dcf555e70
-
SHA1
0de7dc340d03d0144aef6692762c482e731f1717
-
SHA256
69bae63d802887e2d994022011465c7f0bc42b1f0adefcee8dcbbfe243118b15
-
SHA512
d9682bf0d38feb0dacc75826928734bf7165e39e44d450392d50f6a6aedf5bf1adf13f9a8556007243299f0c6cae5646df8c6a2de6db5c1ebb759ec79c6b6cee
Static task
static1
Behavioral task
behavioral1
Sample
40987654323456789098746789098765432345678.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
40987654323456789098746789098765432345678.exe
Resource
win10-en-20211208
Malware Config
Extracted
Protocol: smtp- Host:
serv3.devmexico.com - Port:
587 - Username:
[email protected] - Password:
3}l^pI#_4K_!
Targets
-
-
Target
40987654323456789098746789098765432345678.exe
-
Size
464KB
-
MD5
b9a4dbf6bb05c4fe97ba541dcf555e70
-
SHA1
0de7dc340d03d0144aef6692762c482e731f1717
-
SHA256
69bae63d802887e2d994022011465c7f0bc42b1f0adefcee8dcbbfe243118b15
-
SHA512
d9682bf0d38feb0dacc75826928734bf7165e39e44d450392d50f6a6aedf5bf1adf13f9a8556007243299f0c6cae5646df8c6a2de6db5c1ebb759ec79c6b6cee
Score10/10-
Matiex Main Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-