General
-
Target
4fbdcc44a7aeee9738c67a3bc33217250d77b2c87125e2f592a55475de66762c
-
Size
565KB
-
Sample
220508-hcc3yscebp
-
MD5
c3441e021209654ea6f7531d8687bd22
-
SHA1
d9f937cefb85f12bca3822ecf118ac824fcec0bc
-
SHA256
4fbdcc44a7aeee9738c67a3bc33217250d77b2c87125e2f592a55475de66762c
-
SHA512
dbf464ece49417fb830e4716ec0e6e9b029a1ca0067c796b6440ff551e91f7f4a6013a77b7611f7f860da13b9f90f6b9a19f1d43b6b216634c26b33fc0b759f0
Static task
static1
Behavioral task
behavioral1
Sample
4fbdcc44a7aeee9738c67a3bc33217250d77b2c87125e2f592a55475de66762c.exe
Resource
win7-20220414-en
Malware Config
Extracted
matiex
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
[email protected] - Password:
italik2015
Targets
-
-
Target
4fbdcc44a7aeee9738c67a3bc33217250d77b2c87125e2f592a55475de66762c
-
Size
565KB
-
MD5
c3441e021209654ea6f7531d8687bd22
-
SHA1
d9f937cefb85f12bca3822ecf118ac824fcec0bc
-
SHA256
4fbdcc44a7aeee9738c67a3bc33217250d77b2c87125e2f592a55475de66762c
-
SHA512
dbf464ece49417fb830e4716ec0e6e9b029a1ca0067c796b6440ff551e91f7f4a6013a77b7611f7f860da13b9f90f6b9a19f1d43b6b216634c26b33fc0b759f0
-
Matiex Main Payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-