General
-
Target
matcha-version-b7eebc919e96477a.zip
-
Size
18.3MB
-
Sample
241109-2rth2asrfw
-
MD5
c3300222aa84a4e1d37946e95e6d3017
-
SHA1
c777c09abc7b6b51a7b35185ff1e15afde719577
-
SHA256
0cf7211f99b8aab9d62160266425b6413b4f5050778bbbfcdd916fb1fd57d0d2
-
SHA512
08feb3ca784cda55c4b2991c657e9d98b64594fa9f4acfc62541db5c0aeb7ddee65836438a372734ff1b21290a00cc50dd224f95688c36a3d2c5f9fab6cc1d59
-
SSDEEP
393216:J8g/BmHdfUM1f/5PaV743SRFUgmNy3z7CiXFvFiKEyJpmuZdsOC:J86mHdr5Gj/mNyD7CiJgKbmu9C
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
X8��%~l.pyc
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
X8��%~l.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
mapper/map.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
mapper/map.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
mapper/matcha-driver.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
matcha.exe
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
matcha.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
loader.exe
-
Size
6.8MB
-
MD5
778d19faa6797d8b17178812eb873638
-
SHA1
de7c7c2ff3be333a7ee22e7c1cf544a33c3e50a6
-
SHA256
46e84b940d02fd62aec006e80b56b52e5cddc86c28e16d959b4837d8b1e1f883
-
SHA512
db8a06e04c2642c2c5cceddb0adb8c0d131b7867b68bcc5a7625f7cdf74bcdaa298d1bf6f83d341255439eee3d1fbd4edd1a7cc6508f3929e1d44d34783b5d61
-
SSDEEP
98304:CgkwN+MdA5wqMr4o8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoaZDJ1n6hBnLq:CgV1gB6ylnlPzf+JiJCsmFMvNn6hVv+
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
-
-
Target
X8��%~l.pyc
-
Size
1KB
-
MD5
e4447adcee9f66207029c34242fb6834
-
SHA1
00d326b8a12a3fd38d46f771c87af3b30337af10
-
SHA256
47ef5b63aa13e951c309e7ec04c687e85d6969a5aa8b9071c2b0f6b4a524dbb9
-
SHA512
c8370dc2ad39d65744e08f19988e941779217c04542f39ba2e9fa6db297ec951a643be236665112b465d67749938944092329b9715b5bfdc6962024b99c54d64
Score1/10 -
-
-
Target
mapper/map.exe
-
Size
5.2MB
-
MD5
91b2e38c78a29587e4bc141c3f048f0e
-
SHA1
720a32e02fb3e9529c193c4cc1874a74c7548146
-
SHA256
02ac7fcef95d3d8ba108c85311412739ec680dcc84e0e6baee6a77aa2271ecff
-
SHA512
f5b256a0544df654e793634a847892fe00ee412bef33bc4011e7f9d6d215ccbaf0d39270dcd832e403e95ddf109d1f643bff68e359c545837c6c17e1d9f248f8
-
SSDEEP
98304:MjqhOJCjRLRWUEjzqRxOdlWb0T8hEjE+R7WFxjQFQ/WbzZC+x2wAP:MesJCjR13EavA8+8+j1RSxjQsWXZul
Score1/10 -
-
-
Target
mapper/matcha-driver.sys
-
Size
9KB
-
MD5
21e0a2d7d9ab804eeb1d7c71b532a681
-
SHA1
2c09d54d71dfbee2eb537844078d74361e1e1dcc
-
SHA256
5d8f2239e861694d3f10884260160259393d56810e8cc3e6cabae4c0d077c905
-
SHA512
bfd6b8f3641750bcce137111b895ad9df33d712cb7f0465d99156accdff6298715a9da5da4003e2ad2bad7867013e9be096c21733946c686b2788a679059bc08
-
SSDEEP
96:xnICc5aHL+i40EzLGenSP+VSHWj7TEGMlOD+1WNBbEpDDIy:JXL+iyzLXSGVYcHg1Wvbon
Score1/10 -
-
-
Target
matcha.exe
-
Size
7.0MB
-
MD5
cce7696bf39f612b48afe51ec7f8735b
-
SHA1
7187d3d9e272044774e2624a50a3285eca82073a
-
SHA256
b2e7dab0b5ec3e9210e16b51c640267b4de205991e8027bee7a82e0e48413776
-
SHA512
41a43d6134a566840e7a95ddf0a3f9d9f4dc2d4276730121598c1ec3237cf67fc457b4aa1f82b5bfa4245acef52bdad0fe6ecc0a9f30a2dd4efbc7b8cf7247ae
-
SSDEEP
98304:yhWoRlQjtdA7nBPKB/u8aXwSk99gtgZjwWnqQSMJ5UuJ7n+zGJoTL14nYSytUm6O:y9lQj7AFI99+GjwalrpIcSL2YSyL6/i
Score1/10 -
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3