Overview

overview

10

Static

static

7

matcha-ext/app.exe

windows11-ltsc_2024-x64

1

matcha-ext/loader.exe

windows11-ltsc_2024-x64

1

matcha-ext/map.exe

windows11-ltsc_2024-x64

10

matcha-ext...er.exe

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    matcha-ext.zip
  • Size 49.1MB
  • Sample260624-fsaawsas3z
  • SHA256 59c8c0891b3b8766950be4c52b4826d3db6e03d2de85017ecf1ee8d509579ec9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bruteratelbackdoorpersistencevmprotect

Malware Config

Targets

    • Target
      matcha-ext/app.exe
    • Size 25.1MB
    • SHA256 cc7b6c89cb5b40a9d9f876d887f3f94ff3a4c12c8db8f9c95bde52a3b80f6cdb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1
    • Target
      matcha-ext/loader.exe
    • Size 5.8MB
    • SHA256 f387640b8a8d28f2902768dbc2f66dce7dfc98503483befd74fe31b3a41c6a10
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      matcha-ext/map.exe
    • Size 13.0MB
    • SHA256 dd3df8d6756fd74f889ad3f39827706aa92a56083b2ed0e52052861238c7077e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoorbruteratelpersistence

    • Family: Brute Ratel C4

      A customized command and control framework for red teaming and adversary simulation.

      backdoorbruteratel

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral3
    • Target
      matcha-ext/updater.exe
    • Size 12.2MB
    • SHA256 170fd4117643a03d739aa35743727e48dcb783a20ad903d38a4efe6d95e5288c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral4

MITRE ATT&CK Enterprise v16

Tasks