General
-
Target
b0677e12d72e6db277aec45035d4fdf1e7c2530716dbb569d273174eccec4877
-
Size
449KB
-
Sample
220319-pgbh9ahfek
-
MD5
0fefe78a6c226caf79629cd3548a97ba
-
SHA1
9e054c90cf8f18f2303c209590475f596bcc56bf
-
SHA256
b0677e12d72e6db277aec45035d4fdf1e7c2530716dbb569d273174eccec4877
-
SHA512
e79aa0ef473d6ec6bc8f87567c2a5a81c2ec157637c8899c5a74aadd8ea8dd3cc9897ae07aba778aa827f079c78aa5ebf28839890e37e23a6bb98a842be6cd2e
Static task
static1
Behavioral task
behavioral1
Sample
b0677e12d72e6db277aec45035d4fdf1e7c2530716dbb569d273174eccec4877.exe
Resource
win7-20220311-en
Malware Config
Extracted
matiex
https://api.telegram.org/bot1474029845:AAESF02q0JZytndFFaKINAGOHrylDk8NpJA/sendMessage?chat_id=1481651786
Targets
-
-
Target
b0677e12d72e6db277aec45035d4fdf1e7c2530716dbb569d273174eccec4877
-
Size
449KB
-
MD5
0fefe78a6c226caf79629cd3548a97ba
-
SHA1
9e054c90cf8f18f2303c209590475f596bcc56bf
-
SHA256
b0677e12d72e6db277aec45035d4fdf1e7c2530716dbb569d273174eccec4877
-
SHA512
e79aa0ef473d6ec6bc8f87567c2a5a81c2ec157637c8899c5a74aadd8ea8dd3cc9897ae07aba778aa827f079c78aa5ebf28839890e37e23a6bb98a842be6cd2e
-
Matiex Main Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-