MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08e6ceffb182a4ee31261cab4331e7187b9bcb1c90dd0cdaa5705be9f3edb544. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08e6ceffb182a4ee31261cab4331e7187b9bcb1c90dd0cdaa5705be9f3edb544
SHA3-384 hash: 683a3625758dc5fea40becd9d6d826053f55a187416dd42478f157943f0d38159df03573763c5db71b92248a260c1a53
SHA1 hash: da805021095cadc08d74cab1d4ac47e7282a95a7
MD5 hash: 3144241884a61f827e526ff3d84b75b5
humanhash: oranges-crazy-paris-mexico
File name:TTQW09000.zip
Download: download sample
Signature Matiex
Create hunting rule
File size:521'019 bytes
First seen:2021-04-19 16:43:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:+29fsxVVKADgOikCSmuTgpiCNIF3poex2qm4IJZOMoYpy:+2q5KcgOtJJhQKzAqvwfy
TLSH 99B423D0D37B5C3D7A64857E2BF8B48AC0636CFC2D1EACFA0192C6641C69BA5C1587B1
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36740414.709.5333.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/08e6ceffb182a4ee31261cab4331e7187b9bcb1c90dd0cdaa5705be9f3edb544
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08e6ceffb182a4ee31261cab4331e7187b9bcb1c90dd0cdaa5705be9f3edb544/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bdtm575rqkso4mjgdsvugmphdb5zxsy4sdoqzwvfobn6t47nwvca._file
Result
Malware family:
matiex
Create hunting rule
Score:
  10/10
Tags:
family:matiex keylogger stealer
Link:
https://tria.ge/reports/210419-d3b3cf2vcn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Loads dropped DLL
Matiex
Matiex Main Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/08e6ceffb182a4ee31261cab4331e7187b9bcb1c90dd0cdaa5705be9f3edb544

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip 08e6ceffb182a4ee31261cab4331e7187b9bcb1c90dd0cdaa5705be9f3edb544

(this sample)

Matiex

Executable exe 7c34a13f4dac51597f1481aca1080adf23ef164c7d01ecfbdbf51321d3b29009

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c34a13f4dac51597f1481aca1080adf23ef164c7d01ecfbdbf51321d3b29009
  
Dropping
MD5 3a68e60f8ca98176976883f3a5ab74b7

Comments