MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 983790f3afb9aa0fb567435bb73750a94e66d134cf6dbc2566089af6d6c0ce34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 983790f3afb9aa0fb567435bb73750a94e66d134cf6dbc2566089af6d6c0ce34
SHA3-384 hash: 38a76dfb5dc1e6bf8a6711ab5b725554e20b409569d60c08e2bc882d3a4522ab0ecd7b5171f6358edc745f38b3050b87
SHA1 hash: 453c7d1d72802950c3b6700e90a346ca03ffd3f3
MD5 hash: 34f43688d7a1abe4f127f7c0ac9820b0
humanhash: magazine-princess-winner-video
File name:Enijidjm.001
Download: download sample
Signature Matiex
Create hunting rule
File size:29'949 bytes
First seen:2022-02-11 08:21:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:CzQBcJ34u9EdEDUgrWf5s7Y9R1RBG4ZA5AXLdFlZh:lw346EdEQq7YL1zGy+A/lf
TLSH T10ED2E1BD0CB6ACA1F8A5D7B5184262855C19E8E444836D03FF14D4D54FA26DC4CFECB5
Reporter cocaman
Tags:001 Matiex zip


Avatar
cocaman
Malicious email (T1566.001)
From: "ing.jbarragan@hotmail.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.57.217]) "
Date: "11 Feb 2022 05:32:01 +0100"
Subject: "Quote Order-AS-377578"
Attachment: "Enijidjm.001"

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/62061cad289e2f3e4fc18b91/reports/2429687b-f11d-4be4-994d-1ad3aac14680/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/983790f3afb9aa0fb567435bb73750a94e66d134cf6dbc2566089af6d6c0ce34
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/983790f3afb9aa0fb567435bb73750a94e66d134cf6dbc2566089af6d6c0ce34/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2022-02-11 02:02:11 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
24 of 42 (57.14%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ta3zb45pxgva7nlhinn3on2qvfhgnujuz5w3yjlgbcnpnvwazy2a._file
Result
Malware family:
matiex
Create hunting rule
Score:
  10/10
Tags:
family:matiex collection keylogger persistence stealer
Link:
https://tria.ge/reports/220211-j9kpqseafr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Matiex
Matiex Main Payload
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip 983790f3afb9aa0fb567435bb73750a94e66d134cf6dbc2566089af6d6c0ce34

(this sample)

Matiex

Executable exe f442097ffe0336d6712267088a4368aa539f51f7ea7d1e950da88c6a42f1b29e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f442097ffe0336d6712267088a4368aa539f51f7ea7d1e950da88c6a42f1b29e

Comments