9a4471bdaf5bedadc15e3ac0f7fadbb32eece0e21db5d3bdfc15069c49002973

Sharing

Copy URL Twitter E-mail

General

Target
Matross-Setup-0.6.5.exe
Size 45.8MB
Sample261110-m9bcvaas5x
SHA256 9a4471bdaf5bedadc15e3ac0f7fadbb32eece0e21db5d3bdfc15069c49002973
MD5 78a99bffec2425b105b5a736b1218fb3
SHA1 11f1bbae015f3b1faeec5c06f6c07f7178c597ff
SHA512 94bbd1442cad26a65034ee4f463bb1688b0c497b1ca23ff0341d20d38ef543728eab4e460be19d1a975638b43bf025abe40b628d1577f699614af9c6f506245d
SSDEEP 786432:aT6sPcNh9gM6yc9nQPyrde08PyRLtqjkVAt6el2JV59GZSmhE0FKCFQC3:aKL9gbjdL8PyRLtPKF+GVhEjCKC3
TLSH
T142B7332F4B32DC4AD1A9AD38325E189573B998A44A3DF291FF03BE46356034ED43A7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Matross-Setup-0.6.5.exe
- Size 45.8MB
- SHA256 9a4471bdaf5bedadc15e3ac0f7fadbb32eece0e21db5d3bdfc15069c49002973
- MD5 78a99bffec2425b105b5a736b1218fb3
- SHA1 11f1bbae015f3b1faeec5c06f6c07f7178c597ff
- SHA512 94bbd1442cad26a65034ee4f463bb1688b0c497b1ca23ff0341d20d38ef543728eab4e460be19d1a975638b43bf025abe40b628d1577f699614af9c6f506245d
- SSDEEP 786432:aT6sPcNh9gM6yc9nQPyrde08PyRLtqjkVAt6el2JV59GZSmhE0FKCFQC3:aKL9gbjdL8PyRLtPKF+GVhEjCKC3
- TLSH
  T142B7332F4B32DC4AD1A9AD38325E189573B998A44A3DF291FF03BE46356034ED43A7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution ransomware
- Renames multiple (1022) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 3c8b2629048c118e4fcf80188cbcdaad3a668270e49fd95d2809feccc98fe220
- MD5 1154b69dd61f3d5594ed9dd1710da622
- SHA1 0aa4fc77cb6221be0055836f922f769665cd87e9
- SHA512 ea36422f3d2c7a468fca405818a984817fae1a70d97697e86c5273d21f13e473d05f35f3dcd28db907b35072449970a324f6d2d3162155ff09ebb9e00c663f41
- SSDEEP 48:S46+/iTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8msofjLl:zkuPbO5tCZBVEAWyMEFv2Cm/L
- TLSH
  T1ABC1A470B3D248B9C591413778A733D36612AE747784504FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
- MD5 79c27de4d1c6d295fefaa70f608f1c67
- SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
- SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
- SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
- TLSH
  T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1dee37f6abb2dec9e767bd022d29386b6b295bbd55bf316d2649b8d298f89e9d
- MD5 879b0aab93b11228a27d6b2e498b95be
- SHA1 f5024d0d44c37443d7c17f1ff80fba301389ed42
- SHA512 427ddc4c01be77dd28a376a78714f5004edbee2df6662500cf11d2f4309fdf9a126d7632a7afd0e28712e851eabf56d9d469eb2f3b6c645923d3476275d6eff6
- SSDEEP 192:JZFon9Dar9s7hdD8oZc41Zf0NQZGdH6E:RonlarK3orqf0NQZGdH
- TLSH
  T1FFE1E93571C02DF3D08A4A717D26B92B83F89826277741708B771AD979E0AE7FD24742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Matross.vbs
- Size 497B
- SHA256 284acbd0b3ba948897c6d961da2815eef64b9210b35616165d2332b415a453f2
- MD5 d56738e26b88a334200f90c78969194f
- SHA1 314af90c6938a9de2fe90be63f6dcaf01f4f6341
- SHA512 a3ee08e6ab5ea5cce93175928348bcff62239eb1b3196ca65396b6063ac38b67792e4bb51ac8e4ae31c9c9ed13653adcf8afc0f40dcc9dbe1474e5d5624295a4
- TLSH
  T15BF09709FD64C6BBDF86090331B2CE1ECB03ED002200E4A88DE1CA6839446BA8DAB481
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  launch.ps1
- Size 4KB
- SHA256 330ba4e4b280e3e03864a773023f752010c7ca76b99f903e4cad6e3a7b805045
- MD5 80470007d93ba017b761bccf20d1205e
- SHA1 9db1da5e6c4f28369fd6ffed38aa9496b3c0607f
- SHA512 07c75230758c15262fd29c237b29a5aa226adb19255b87ba97e1679169cc1f6c58f9c147abb2cb74781b27420f28203dcf2da6eb540f84616781689c66e45270
- SSDEEP 96:Bd7mZMuMjQ50+Du8hx4Yv61RkPY8AIkRQHBV0INYBhBwl1DR/CEHpRbCEdaf/UiK:BVmNOYv61Ow8eRQHH0INSXSD5lrblof6
- TLSH
  T13991F80E2D80229ACEE9462FA1C89641E70E85BD680E7D1C107E55C63FA67BF4B693D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  lib/accounts.js
- Size 10KB
- SHA256 dbd353f2af22b4c90016dcd74785a2729dffe987159390a47feb293b75acbd54
- MD5 f7ec1ebb53f9b428580c030e240161bd
- SHA1 f35a1500e1f80deeae0ccbb878c5cfcffd2b981b
- SHA512 8c3a2951c575388218a139c2581c2f961d63aeb28f75001a11d20df8d0f4bb86c2cbda4e5e119344f908a05d0b56d100f57ecf82d4d9e7dae01d8d0cb93eb9a4
- SSDEEP 192:htKj0qJtcIJZYRes/yUXjUXAfqxNYzsi6yHrBouuTE5Ct3TvwM6Lpdvi2BCHH0Ke:nKj0qJtBZo1yUXjUXAixSsi68NDuTE5n
- TLSH
  T13032B400B394A871C7D194D02033460EE369556BB02BAAFCE5BC65EB7872D8F2677F19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  lib/api.js
- Size 33KB
- SHA256 ee1728956f6d41cf5de665e6260094ac6eef34913af77ba659560a2da79b76f3
- MD5 9cc1191cf9ac4f7f80c233353fed4773
- SHA1 b30bc6e05156a1e2ff5869c65dbcac2a4fb7e6ad
- SHA512 5fc68c4460ad18d2c726d91305cd2d4bbd1947ab640a0ff5ee7dd41c143602eeb5323a45ce0f04688f15e0fce36ff95264eefd3136517aca4be9be13023fa981
- SSDEEP 768:ol/+tDmR0Fdjw9EHQTGJwpEZfyKrLmnOBDrBKXEE1r39SRKeLCnYKCbVzVadKoDK:olt0T0O2pnOlE5JtYBqd5Uk5OYO7f
- TLSH
  T1ACF21AB9A1090E010BF9B6ED7C5E10027E361D49387980936FBC8E6756AA5C7CF3753A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  lib/audio.js
- Size 3KB
- SHA256 0c49d6f833325967462d10531fa5c8a8a3a4027acfcc5fe093195c5020a31999
- MD5 1eed645a0dc0d781abe7590a59f46481
- SHA1 99d8f744c87e8a9265101942b2c6d9ddd0ecad2b
- SHA512 2e031c819c35f21d25f783963fe1eb36bba128983001a63f85dfa84d0dcd296eca12eacfb021dda82cdbe7b5408562fbf0536d8816a1044f3d06c9f0d99cb887
- TLSH
  T1B6614559B07120224B6585E0196A0045246D6D1E302AD6F0F5BFAF6E3ABF05DB73EE3E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  lib/automation.js
- Size 14KB
- SHA256 c17e25fd639e51bbf20c743a70883a97e33a312ffc53e3d78a15fe66b85b3646
- MD5 6ff1109b094851f38d9eedacc8fe5296
- SHA1 7bdb94a88d52503fb21523caeb51390e14b4043b
- SHA512 bb030370b41ab6488326166dd116a9278e97363e65b32684753020ac7d7208f3d1fbcf5cd100a10cfa2422bb456c4c63326fec50f15e50ed8464b8deec78211f
- SSDEEP 384:rjpQP5OQd94LIS7Ekxxi12TMR7wdu/goTu+e9rtIu43G9kSqE6F4VH8NzhuhmSSk:ryjVE+e5OuTJcEpyQG0
- TLSH
  T1B462B694F2D574710AEBB0F670623000BC7C582D305B84D5E49E84BB3AFA9859B7BE2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  lib/avatars.js
- Size 4KB
- SHA256 9d85f9ec44850414006f22d601c0c90c1696c57a52af269e7e9ba2319c1e57ac
- MD5 bb484ec3611de330fd1741abafce6153
- SHA1 f0c013402598583f12bea424c43666f7b30cda41
- SHA512 268806313ec6ccb26cf1ad2bd1805aac35180b8f9f9ea32084d924fd65793ad6c5cc832ecda3b7e7523e2861a130daed301834fc899ef83b58bddc9d42a69c21
- SSDEEP 96:3UUUKeUqZjnJibc+U+7eHvkHs4w/0HrWBKr2jB0HrWgDETgrKCz60Y2/P+eZG5at:kMnmjyzU+7eH8Hs5gKBVBgKgD2CAqP+Q
- TLSH
  T120A1A8B0A3E562364F9423E589290B62F13E8F17391AE485E47CBC4738BA00971B763C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  lib/cloud.js
- Size 33KB
- SHA256 371a39dfc3f48f1b822ede34763438862de33863b0cc98196e224b1e621a1f60
- MD5 27a5d218e9a34d92845f2b9478cd5d3c
- SHA1 24816308e49855bcdd9c1735db30f7e261762aa7
- SHA512 c38e2b92c670169464222797eac0d462a89778f318660c82c0e773fb8372a107c270a91cab9b4e2cb61247079950636cc267b4fe4d1040cbb8a1cc3a9081d27e
- SSDEEP 768:aLhccA63Y0NDdq3V0cOhAFQJriyW2DvZzuObZXv0mQnJGfIjmQ8guKkatIkJ7TLa:fOhA2YiwU3fOtN+3
- TLSH
  T1BFF293447BC0A465234B6EB3361F60D5F22F08CE3898495BD315BC91B6E1326EBF6939
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  lib/cs2.js
- Size 12KB
- SHA256 62a6e0bbe367b240d35986f75e5ba595737474c478ebb6b3966aa1ad0fe41ac4
- MD5 648d32cdf5000e2b4dfa07314dbb158b
- SHA1 25ec4c09792b008d76f04ad8ad39d10bf177fdeb
- SHA512 6950d5ed8087f78788a845096db656086cd52c69d9b6366ed5117abed70667f670ffae21c699c6ffaaa3fdf5820b91bc767de4b3d4a2620ed14f8e0e92be07f7
- SSDEEP 384:Xoq89nOgGOHYKuoWrUUQfspocZsIdVtLXK7ZIx4H+MrezsGne+:XfgDzuoWrUUQfspBZsIL1XK9Ix4ternD
- TLSH
  T1F0523B0EB943253B82E199F118754115E27E4F30300B94A0E97F5AB376BE54AB32FDA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  lib/discord.js
- Size 503B
- SHA256 043a6c61b99fe08d73d381a558248a7142b5db1bc36fee88d85b282ecdd0bbcb
- MD5 afe9612c69f235253efc6c4fdfffa278
- SHA1 a37f62c12afa5327104f49086f7fb122a4cb751e
- SHA512 332fb9e09079b70c834b3ba5368f858415c7775f2ef81f17d8e10e26b2a815114d818fe166ae51360719a501ca5f8f875ed5ddd8a1313ae9363df9be823f372f
- TLSH
  T1C9F0C0EC2442250500880F2107F05E5777A64332A06F58E1E0566702290F0D276BBB02
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  lib/edition.js
- Size 2KB
- SHA256 50ad0ab5b332151040f080abace0c57081357230709c45449a185a7d9e18973a
- MD5 14c1e75459d86b691b0ebe80b4ba2d96
- SHA1 041ed08930255b2868a8de0c046f2b4291408a18
- SHA512 62e2ddfab367d260e1942ef22c150f595774ae9949df7f10a63e8747c652b3a691ca298e099febc5e06fe8460781cd1ff6ae81873d4be6617fc575ce230abfef
- TLSH
  T15E4111A436C107612B175B9FF63366D0EC2E98AE7DE4085EC118BAC13E04D60CAC1BB6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Renames multiple (1022) files with added filename extension

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32