MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ed96cf4589be7b6b9b9562a165f4587ecf61e70a4958fb524f75c8b7c0b3fc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Matiex

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	0ed96cf4589be7b6b9b9562a165f4587ecf61e70a4958fb524f75c8b7c0b3fc9
SHA3-384 hash:	0824b4489f39db54c2bb37708a403707b329517f9e8a7a6123b4022c22f8d5ef7c121d51a2acc4fcc936887f7d18405d
SHA1 hash:	084e85f67c1743bc12a6bdea960a3fd34025cf51
MD5 hash:	0b52424adb115b1336d084cf0cfbb73e
humanhash:	texas-winter-magazine-maryland
File name:	SecuriteInfo.com.Variant.MSILPerseus.230371.19209.20229
Download:	download sample
Signature	Matiex Create hunting rule
File size:	732'160 bytes
First seen:	2020-09-17 09:03:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger)
ssdeep	12288:RDhxrUNCKpoxLfz7SzJHtODOWFg3W/jwG4cxxPtUU+GwGp:xWCcoxjqJHt0Hg3ijwJ4z+Sp
Threatray	601 similar samples on MalwareBazaar
TLSH	36F47D18AC6C8C10CB161777C589A81E5258AC037BF2D9EF7B8B325B43797F2A5711AC
Reporter	SecuriteInfoCom
Tags:	Matiex

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/62792/

Detection(s):

SecuriteInfo.com.Variant.MSILPerseus.230371.19209.20229.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Using the Windows Management Instrumentation requests

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Launching the process to change network settings

Result

Threat name:

Matiex

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/468893

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal WLAN passwords

Tries to steal Mail credentials (via file access)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Yara detected AntiVM_3

Yara detected Matiex Keylogger

Yara detected MultiObfuscated

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0ed96cf4589be7b6b9b9562a165f4587ecf61e70a4958fb524f75c8b7c0b3fc9/

Threat name:

ByteCode-MSIL.Backdoor.Androm

Status:

Malicious

First seen:

2020-08-11 07:42:13 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=b3mwz5cytpt3nonzkyvbmx2fq7wpmhtqusky7nje65oiw7alh7eq._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/200917-scxmk6c7ej/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies service

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0ed96cf4589be7b6b9b9562a165f4587ecf61e70a4958fb524f75c8b7c0b3fc9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.