matiex | 20230419492af928bf7209037aab62c05b82a75aalinaaspxspycerberdarkcometderusbidridexinceptionjratlazagnelockbitmiragenautilusneuronplugxredleavesrurktarsliverth3bugutkonoswannacrywebshellshellwinntiyayih[.]exe

Resubmissions

12/06/2023, 09:02

230612-kzv86abg4t10

06/05/2023, 23:59

230506-31vm5aad4910

Sharing

Copy URL Twitter E-mail

General

Target
20230419492af928bf7209037aab62c05b82a75aalinaaspxspycerberdarkcometderusbidridexinceptionjratlazagnelockbitmiragenautilusneuronplugxredleavesrurktarsliverth3bugutkonoswannacrywebshellshellwinntiyayih.exe
Size 5.0MB
Sample230506-31vm5aad49
SHA256 91caa1fe289cdd8500399b3dcb07a5417223126a8cfd6833ece052acaaeb27f7
MD5 492af928bf7209037aab62c05b82a75a
SHA1 c24a6f7736e125620abed012b4545ddeeac0675e
SHA512 0fbacf27a474203fe2c29e5c62b5c3d86803901a69e5ce538f9c2e09e42a0f7e4faff39eb0ae76a58a53412d49ae31ba86123fb28f28f1912ea54aa372cd48af
SSDEEP 49152:3Gbf5gfKJu0zf4R+oUN+edPTPR5Y0Pf/deh/1XwshSLGI/trdxblHK:cFlRm01+j0BA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

miner pdf link matiex snakekeylogger xmrig ardamax metasploit

Malware Config

Signatures

Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
sample	family_ardamax

Matiex Main payload 1 IoCs

resource	yara_rule
sample	family_matiex

Matiex family
matiex
Metasploit family
metasploit

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
sample	pdf_with_link_action

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20230419492af928bf7209037aab62c05b82a75aalinaaspxspycerberdarkcometderusbidridexinceptionjratlazagnelockbitmiragenautilusneuronplugxredleavesrurktarsliverth3bugutkonoswannacrywebshellshellwinntiyayih.exe

File Explorer

20230419492af928bf7209037aab62c05b82a75aalinaaspxspycerberdarkcometderusbidridexinceptionjratlazagnelockbitmiragenautilusneuronplugxredleavesrurktarsliverth3bugutkonoswannacrywebshellshellwinntiyayih.exe

.exe 5.0MB

20230419492af928bf7209037aab62c05b82a75aalinaaspxspycerberdarkcometderusbidridexinceptionjratlazagnelockbitmiragenautilusneuronplugxredleavesrurktarsliverth3bugutkonoswannacrywebshellshellwinntiyayih.exe

SHA256 91caa1fe289cdd8500399b3dcb07a5417223126a8cfd6833ece052acaaeb27f7
MD5 492af928bf7209037aab62c05b82a75a
SHA1 c24a6f7736e125620abed012b4545ddeeac0675e
SHA512 0fbacf27a474203fe2c29e5c62b5c3d86803901a69e5ce538f9c2e09e42a0f7e4faff39eb0ae76a58a53412d49ae31ba86123fb28f28f1912ea54aa372cd48af
SSDEEP 49152:3Gbf5gfKJu0zf4R+oUN+edPTPR5Y0Pf/deh/1XwshSLGI/trdxblHK:cFlRm01+j0BA
MD5 SHA1 SHA512 SSDEEP

windows x86

Ardamax main executable
Matiex Main payload
Snake Keylogger payload
XMRig Miner payload

miner
HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

480

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths