MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f16b478c89a680a108e8fd07cd46fc553978819135a21208bb0e8f92e2fdd794. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Matiex

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	f16b478c89a680a108e8fd07cd46fc553978819135a21208bb0e8f92e2fdd794
SHA3-384 hash:	fb4fa87d19377ce85e16951b7e001a838bd706e446388fc47a4073f7d2ef34936cfeb4ddb201c5a2d50222053e53f08b
SHA1 hash:	c03d0b183e9ace35accf541b224ca28e13e6b8c8
MD5 hash:	ad71896a1e4a2fcd65d73f28dce380f9
humanhash:	hotel-east-tennis-white
File name:	invoice copy.pdf.exe
Download:	download sample
Signature	Matiex Create hunting rule
File size:	416'768 bytes
First seen:	2020-07-31 05:53:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:9iU6u56yfIFvaj6gZWjsAiCn1i9FBMzgt:9iU6u56j85WjsAiC1iGz
Threatray	91 similar samples on MalwareBazaar
TLSH	3E94BE5CB1DA251AF51231BF8FF9829BCEAAE06F1287416B12752597807DB0C6EC1F31
Reporter	abuse_ch
Tags:	exe Matiex

abuse_ch

Malspam distributing unidentified malware:

HELO: biz.vnpt.vn
Sending IP: 37.48.83.10
From: Acount Director <kieu.lt@biz.vnpt.vn>
Subject: Proforma Invoice
Attachment: invoice copy.pdf.z (contains "invoice copy.pdf.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/35790/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Sending an HTTP GET request

Reading critical registry keys

Result

Threat name:

AgentTesla Matiex

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/404511

Signature

Executable has a suspicious name (potential lure to open the executable)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Sigma detected: Scheduled temp file as task from temp location

Sigma detected: Suspicious Double Extension

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to steal Mail credentials (via file access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected AgentTesla

Yara detected AntiVM_3

Yara detected Matiex Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f16b478c89a680a108e8fd07cd46fc553978819135a21208bb0e8f92e2fdd794/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-31 05:55:09 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6fvupdeju2akcchi7ud42rx4ku4xramrgwrbecf3b2hzfyx526ka._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/200731-a53jb46v22/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Program crash

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f16b478c89a680a108e8fd07cd46fc553978819135a21208bb0e8f92e2fdd794

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.