MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55c0336516e7af87c54ba6aa41430296f541549ff96871a77a01f725ea757147. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55c0336516e7af87c54ba6aa41430296f541549ff96871a77a01f725ea757147
SHA3-384 hash: 9f8db3a5942ddb4d9a7a573276eed7974d0b269591f7c70ed039eeb39a2adc05e6fa4730ab0983c57788aad42b1a6e6d
SHA1 hash: 8961954ab95af977e5df3328c798518f6640fa7c
MD5 hash: d737b3e50711d626e50f55db83908747
humanhash: bravo-berlin-east-ack
File name:SK-0177.exe
Download: download sample
Signature Matiex
Create hunting rule
File size:498'176 bytes
First seen:2020-11-17 11:59:31 UTC
Last seen:2020-11-19 14:47:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 6144:A8rDbcjb4X7L78Fri/R48l3V/1Wsv287b1MUDfiAcIET/U1SN:A8rEjbUL/Rjl3uShp1fiAct7U1Y
Threatray 474 similar samples on MalwareBazaar
TLSH A0B45CB27D92586ECA6B077540A985C1FABA16C73FA08B0D716F430C0F11A2BFB57257
Reporter JAMESWT_WT
Tags:Matiex

Intelligence

File Origin
# of uploads :
3
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.16439.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Running batch commands
Launching a process
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55c0336516e7af87c54ba6aa41430296f541549ff96871a77a01f725ea757147/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 09:03:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kxadgziw46xyprklu2vecqycs32ucve77fuhdj32ah3sl2tvofdq._file
Verdict:
unknown
Similar samples:
156b8eeeaed97f542da5218c8c0a4117b5fb5865ff6094b5546442d912f5366e
Matiex
82446517e2f7d10ebdcd79f92643bcecdebf915ee9cc387bec1f7ca6baf9608d
Matiex
8c6c41d8e0f478b1be11b938bf83066e8cf7a8b294c18c91e0b2570f464bc6d2
Matiex
91de70857ce9dbf596a67b2abad7552a467fcc2a155d349799261fb8585e6c18
Matiex
95ccbdefafb7f4b5e2a505d3681803940a8fa7a5cae06ee56036009b4253c5ac
Matiex
ac9239da18d97131d83ae2d9a24cbdfc0c4f5c232bb04bbeb0e6931e9ac5cc98
Matiex
b511fbc6adf655af3e693e7a7081e62f26eacd616273f625a8e9c3568420e1fc
Matiex
bfe1e40c9ca65dbaee9d648bb9f577e1791d4ab8feeff95758e7604bbcfbe639
Matiex
cf68e1b1e8e89cf03b0d721957c794936947c8cf5f8c30401c20e075e4b37c6e
Matiex
ff3e2f2fe988d10c72aa056a9220a32e6ed9db7204df93713aa9451682c2c630
Matiex
+ 464 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/201117-46ph812kxa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
55c0336516e7af87c54ba6aa41430296f541549ff96871a77a01f725ea757147
MD5 hash:
d737b3e50711d626e50f55db83908747
SHA1 hash:
8961954ab95af977e5df3328c798518f6640fa7c
Link:
https://www.unpac.me/results/634de47a-c77a-42ad-b350-ddd950bd2531/
SH256 hash:
2abc60375ffbca5f70cacf88e9417d17ce0b5c4d6881cdafbf0ece3df799e31b
MD5 hash:
50d746d32b0f32891dedbf8046267a72
SHA1 hash:
771165b5d9b9cccdcd29cf6010ac379996733cb0
Link:
https://www.unpac.me/results/634de47a-c77a-42ad-b350-ddd950bd2531/
SH256 hash:
6e7156ff4287bf6a83d88eaff1c4e9ff586b2ed9a6265d6e98c5e074eb025282
MD5 hash:
8778cdc547a743aed714afea5d1227af
SHA1 hash:
b12215c2b847aea0aa5e1158fa69072bad2a985d
Link:
https://www.unpac.me/results/634de47a-c77a-42ad-b350-ddd950bd2531/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/634de47a-c77a-42ad-b350-ddd950bd2531/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_Snake
Create hunting rule
Author:ditekSHen
Description:Detects Snake Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Matiex

Executable exe 55c0336516e7af87c54ba6aa41430296f541549ff96871a77a01f725ea757147

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/825872/
  
Delivery method
Distributed via web download

Comments