MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8adc83591c26ae2a90982a1d19b837137d61898c2891b4b572e12804595def72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Matiex

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	8adc83591c26ae2a90982a1d19b837137d61898c2891b4b572e12804595def72
SHA3-384 hash:	727424083d841a376a8a2dcbe30b3fa4a63687e1191e86b2fa3e90feb9559c08524668d82041a1f58b901345037e8a2a
SHA1 hash:	be0d3e6dc7acd726bd3ab75fd2d72a6229d8b8f8
MD5 hash:	f7a8b40a603e34ba1d54432963f39836
humanhash:	delta-robert-october-chicken
File name:	413110_201005200740.pdf.exe
Download:	download sample
Signature	Matiex Create hunting rule
File size:	141'104 bytes
First seen:	2020-10-08 12:41:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	1536:KZDk1ZXVpjI5IdbylxPngMYmHxmpqF8WIdN6HOAhyDK+yJVONrw+qqXgmo2lUfk:RdfM2bgxPgMYmRE/RdEH5x+yJJmgmDJ
Threatray	3 similar samples on MalwareBazaar
TLSH	43D30672590C7E92DA780BF417332BC247B9B4820552C2FD48C97C9BB6D569E3A4B78C
Reporter	abuse_ch
Tags:	exe GarantiBBVA geo Matiex TUR

abuse_ch

Malspam distributing Matiex:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.57.209
From: Garanti BBVA Internet <dekont@garantibbva.com.tr>
Subject: DEKONT
Attachment: 413110_201005200740.pdf.rar (contains "413110_201005200740.pdf.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

113

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a process with a hidden window

Sending a UDP request

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun

Enabling autorun by creating a file

Result

Threat name:

Matiex

Detection:

malicious

Classification:

troj.adwa.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/485394

Signature

Connects to a pastebin service (likely for C&C)

Creates an undocumented autostart registry key

Drops PE files to the startup folder

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Capture Wi-Fi password

Sigma detected: Suspicious Double Extension

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal WLAN passwords

Tries to steal Mail credentials (via file access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses netsh to modify the Windows network and firewall settings

Yara detected Matiex Keylogger

Yara detected MultiObfuscated

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8adc83591c26ae2a90982a1d19b837137d61898c2891b4b572e12804595def72/

Threat name:

ByteCode-MSIL.Trojan.Wacatac

Status:

Malicious

First seen:

2020-10-08 09:48:55 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rloigwi4e2xcveeyfiortobxcn6wdcmmfci3jnls4euaiwk555za._file

Verdict:

unknown

Matiex

8d87d1e973d1ee16d747824541196d5df60298f4a8b0e24cf0ad684bb69b779c

Matiex

a83313423eb4ec63591766985452770fa671506b821b927dd015b9e919fcad11

Matiex

Result

Malware family:

matiex

Score:

10/10

Tags:

evasion spyware stealer keylogger family:matiex persistence

Link:

https://tria.ge/reports/201008-4kpd4qzena/

Behaviour

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Modifies service

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Maps connected drives based on registry

Checks BIOS information in registry

Drops startup file

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks for VMWare Tools registry key

Looks for VirtualBox Guest Additions in registry

Matiex

Matiex Main Payload

Modifies WinLogon for persistence

Unpacked files

SH256 hash:

8adc83591c26ae2a90982a1d19b837137d61898c2891b4b572e12804595def72

MD5 hash:

f7a8b40a603e34ba1d54432963f39836

SHA1 hash:

be0d3e6dc7acd726bd3ab75fd2d72a6229d8b8f8

Link:

https://www.unpac.me/results/eb157750-a074-4030-a761-a0eb22157488/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Eldorado

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/8adc83591c26ae2a90982a1d19b837137d61898c2891b4b572e12804595def72

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.