MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5dcbffef867b44bbb828cfb4a21c9fb1fa3404b4d8b6f4e8118c62addbf859da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Matanbuchus


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments

SHA256 hash: 5dcbffef867b44bbb828cfb4a21c9fb1fa3404b4d8b6f4e8118c62addbf859da
SHA3-384 hash: 9462de09016e9b9cf95e6598aa32d826a6d7b5366bb732a8028398a9ea8227f5cc009e23d5df9a32fba115fc1f9d5708
SHA1 hash: 85a659971ad5aea58ff20a078532e688f7e1659b
MD5 hash: 4d5da2273e2d7cce6ac37027afd286af
humanhash: mars-lithium-aspen-west
File name:5dcbffef867b44bbb828cfb4a21c9fb1fa3404b4d8b6f4e8118c62addbf859da
Download: download sample
Signature Matanbuchus
File size:229'376 bytes
First seen:2022-06-17 06:06:04 UTC
Last seen:2022-06-17 06:43:15 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 6144:zi4SAoa1aq9oOGwFVL4/QUDDNHdOxOzd5:zi4SAoal9ogFVCDnNHdO+3
TLSH T11E24024A7B044538D01667392FDBF6E687367C8C8EAB49526297F32C2DB31A051735F8
Reporter @JAMESWT_MHT
Tags:matanbuchus msi signed Westeast Tech Consulting Corp.

Code Signing Certificate

Organisation:Westeast Tech Consulting, Corp.
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2022-05-18T00:00:00Z
Valid to:2023-05-11T23:59:59Z
Serial number: 061a27a3a3771bb440fc16cadf2675c4
Intelligence: 9 malware samples on MalwareBazaar are signed with this code signing certificate
Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 9ed703ba7033af5f88a5f5ef0155adc41715d3175eec836822a09a93d56e4b7f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence


File Origin
# of uploads :
2
# of downloads :
4'156
Origin country :
IT IT
Mail intelligence
No data
Vendor Threat Intelligence
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Document contains OLE streams with names of living off the land binaries
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.MatanbuchusLoader
Status:
Malicious
First seen:
2022-06-16 21:35:34 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Result
Malware family:
matanbuchus
Score:
  10/10
Tags:
family:matanbuchus loader
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Enumerates connected drives
Loads dropped DLL
Blocklisted process makes network request
Matanbuchus

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments