matiex | 2023-04-25_c21d96eb8a9e9ecad75a400108c697cc_alina_aspxspy_cerber_cobalt-strike_darkcomet_derusbi_dridex_inception_jrat_lazagne_lockbit_mirage_nautilus_neuron_plugx_redleaves_remcos_rurktar_sliver_th3bug_utkonos_wannacry_webshell-shell_winnti_yayih[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
2023-04-25_c21d96eb8a9e9ecad75a400108c697cc_alina_aspxspy_cerber_cobalt-strike_darkcomet_derusbi_dridex_inception_jrat_lazagne_lockbit_mirage_nautilus_neuron_plugx_redleaves_remcos_rurktar_sliver_th3bug_utkonos_wannacry_webshell-shell_winnti_yayih.bin
Size 5.0MB
Sample230430-24dncagd85
SHA256 56a2b327c8405acce397302e6af14dc34a561627056f1ff4d88adbdd8f64a232
MD5 c21d96eb8a9e9ecad75a400108c697cc
SHA1 5072be679c8d9865fcb965a25d10988493cc2e33
SHA512 c9fa9a61749af46e29cd64bed197639fb11eda7424fd8f1b621c7bc60ac16f31cc55976bc0a907ab867e37845007c0a30b10c89cccd68fd731b3c588bff20f07
SSDEEP 49152:9Gbf5gfKJu0zf4R+oUN+edPTPR5Y0Pf/deh/1XwshSLGI/trdxblHK:KFlRm01+j0BA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

miner pdf link matiex snakekeylogger xmrig ardamax metasploit

Malware Config

Signatures

Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
sample	family_ardamax

Matiex Main payload 1 IoCs

resource	yara_rule
sample	family_matiex

Matiex family
matiex
Metasploit family
metasploit

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
sample	pdf_with_link_action

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-04-25_c21d96eb8a9e9ecad75a400108c697cc_alina_aspxspy_cerber_cobalt-strike_darkcomet_derusbi_dridex_inception_jrat_lazagne_lockbit_mirage_nautilus_neuron_plugx_redleaves_remcos_rurktar_sliver_th3bug_utkonos_wannacry_webshell-shell_winnti_yayih.bin

File Explorer

2023-04-25_c21d96eb8a9e9ecad75a400108c697cc_alina_aspxspy_cerber_cobalt-strike_darkcomet_derusbi_dridex_inception_jrat_lazagne_lockbit_mirage_nautilus_neuron_plugx_redleaves_remcos_rurktar_sliver_th3bug_utkonos_wannacry_webshell-shell_winnti_yayih.bin

.exe 5.0MB

2023-04-25_c21d96eb8a9e9ecad75a400108c697cc_alina_aspxspy_cerber_cobalt-strike_darkcomet_derusbi_dridex_inception_jrat_lazagne_lockbit_mirage_nautilus_neuron_plugx_redleaves_remcos_rurktar_sliver_th3bug_utkonos_wannacry_webshell-shell_winnti_yayih.bin

SHA256 56a2b327c8405acce397302e6af14dc34a561627056f1ff4d88adbdd8f64a232
MD5 c21d96eb8a9e9ecad75a400108c697cc
SHA1 5072be679c8d9865fcb965a25d10988493cc2e33
SHA512 c9fa9a61749af46e29cd64bed197639fb11eda7424fd8f1b621c7bc60ac16f31cc55976bc0a907ab867e37845007c0a30b10c89cccd68fd731b3c588bff20f07
SSDEEP 49152:9Gbf5gfKJu0zf4R+oUN+edPTPR5Y0Pf/deh/1XwshSLGI/trdxblHK:KFlRm01+j0BA
MD5 SHA1 SHA512 SSDEEP

windows x86

Ardamax main executable
Matiex Main payload
Snake Keylogger payload
XMRig Miner payload

miner
HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

480

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths