MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ea222802308d610bd7d4cc4034b7d29258c65bbd42580a87a8b1fec227fb11d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 4ea222802308d610bd7d4cc4034b7d29258c65bbd42580a87a8b1fec227fb11d
SHA3-384 hash: 335c5687e059013680e6bc50d8e5a874c07fbf0ad6c5804e03d51d59df8e34281b4c3d7949f1636def7dd2d0ccf30b25
SHA1 hash: c98a74a0d5e41e07fc8ec2e35fa4f491abdd11d7
MD5 hash: d1af1a8b0975b5c62a095f147e785535
humanhash: oklahoma-glucose-pennsylvania-whiskey
File name:matiex.exe
Download: download sample
Signature Matiex
File size:199'680 bytes
First seen:2020-07-31 16:34:13 UTC
Last seen:2020-07-31 17:40:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:2o+jiaHDHXFeggYIgA2K0aRpRF15RNNSVDlXdzNPl6VLB7lDJjFExLBnJj5XxWTM:0FXFeggYIgAdrZ
TLSH CE141BBE3B46AD21CBADD3B8C6824215C2F4E746062BB30F4ED699B51F182CDB5471C6
Reporter @James_inthe_box
Tags:exe Matiex

Intelligence


File Origin
# of uploads :
2
# of downloads :
49
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Result
Threat name:
AgentTesla Matiex
Detection:
malicious
Classification:
troj.spyw
Score:
72 / 100
Signature
Machine Learning detection for sample
May check the online IP address of the machine
Tries to steal Mail credentials (via file access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected Matiex Keylogger
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Bluteal
Status:
Malicious
First seen:
2020-07-31 16:34:07 UTC
AV detection:
21 of 31 (67.74%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Looks up external IP address via web service
Looks up external IP address via web service
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Threat name:
Malicious File
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments