General
-
Target
b4fd099f95248286fb005d5fc93399d9.exe
-
Size
477KB
-
Sample
220301-vzabssahc6
-
MD5
b4fd099f95248286fb005d5fc93399d9
-
SHA1
4fca12d0d25a2115b5958de3aa9830f36361fbbb
-
SHA256
d8924e2835e52e70b5c4fa4fa0a91e9b06776f778d065d62773a4564586d486c
-
SHA512
05c742c18b03adb4153f1f921311f4aaba01ddc04cd329a8079bd9b56db46ab45cfae32c7a88db3becde49f76859a6c24452fa6dbd1c1738bb0d59e8aa45f2ef
Static task
static1
Behavioral task
behavioral1
Sample
b4fd099f95248286fb005d5fc93399d9.exe
Resource
win7-20220223-en
Malware Config
Extracted
matiex
https://api.telegram.org/bot1474029845:AAESF02q0JZytndFFaKINAGOHrylDk8NpJA/sendMessage?chat_id=1481651786
Targets
-
-
Target
b4fd099f95248286fb005d5fc93399d9.exe
-
Size
477KB
-
MD5
b4fd099f95248286fb005d5fc93399d9
-
SHA1
4fca12d0d25a2115b5958de3aa9830f36361fbbb
-
SHA256
d8924e2835e52e70b5c4fa4fa0a91e9b06776f778d065d62773a4564586d486c
-
SHA512
05c742c18b03adb4153f1f921311f4aaba01ddc04cd329a8079bd9b56db46ab45cfae32c7a88db3becde49f76859a6c24452fa6dbd1c1738bb0d59e8aa45f2ef
-
Matiex Main Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-