MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9880d363ec81176e27377116d1c8a0771ff8309b51debe1f547e27e91bb823a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Matiex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	a9880d363ec81176e27377116d1c8a0771ff8309b51debe1f547e27e91bb823a
SHA3-384 hash:	094f6564c208bedfe8cfe5a86e02a53e3e5d9810bf445cd09e7c02c0caae13d2a91197bdad517f69450f308eba7516c7
SHA1 hash:	c7253b66117a8d19af8e1ebdd32715cbb6cf9187
MD5 hash:	d59ea08741d2c41373084b0bbd5d39e8
humanhash:	minnesota-asparagus-oranges-romeo
File name:	RFQ Shipment Invoice.exe
Download:	download sample
Signature	Matiex Create hunting rule
File size:	750'592 bytes
First seen:	2020-10-13 07:38:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:GAjSjpVxw5YpqkcnH+hHMLbHK4RNxFfZWXXvS5328cWTEd4MYn2gKwkx3qq:GcAVGCkkcnHC+tTx52q532ATEe32F3qq
Threatray	22 similar samples on MalwareBazaar
TLSH	77F4122C77AC8656CA6F41B9B4A106801B34E51F706BD7D72784F8E92BDA304CD25BB2
Reporter	abuse_ch
Tags:	exe Matiex

abuse_ch

Malspam distributing unidentified malware:

HELO: tonyhai
Sending IP: 45.127.62.180
From: forni@materia.cf
Reply-To: anelem@suprahealthcare.net
Subject: FW: Re: RFQ Shipment//Invoice SMI/730
Attachment: RFQ Shipment Invoice.pdf.rar (contains "RFQ Shipment Invoice.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/70316/

Detection(s):

SecuriteInfo.com.Variant.Bulz.138180.12835.18347.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Connection attempt

Forced shutdown of a system process

Setting a global event handler for the keyboard

Unauthorized injection to a system process

Result

Threat name:

Matiex

Detection:

malicious

Classification:

troj.spyw.evad

Score:

69 / 100

Link:

https://www.joesandbox.com/analysis/489323

Signature

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Sigma detected: RegAsm connects to smtp port

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected Matiex Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a9880d363ec81176e27377116d1c8a0771ff8309b51debe1f547e27e91bb823a/

Threat name:

ByteCode-MSIL.Trojan.Malrep

Status:

Malicious

First seen:

2020-10-12 20:40:12 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vgea2nr6zaixnytto4iw2heka5y77ayjwuo6xypvi7rh5en3qi5a._file

Result

Malware family:

matiex

Score:

10/10

Tags:

spyware stealer keylogger family:matiex

Link:

https://tria.ge/reports/201013-cndw9wt562/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Matiex

Matiex Main Payload

Unpacked files

SH256 hash:

a9880d363ec81176e27377116d1c8a0771ff8309b51debe1f547e27e91bb823a

MD5 hash:

d59ea08741d2c41373084b0bbd5d39e8

SHA1 hash:

c7253b66117a8d19af8e1ebdd32715cbb6cf9187

Link:

https://www.unpac.me/results/01f7d2b9-ce2d-4df4-ad3b-65959eda7b8b/

SH256 hash:

6ed63515503bed3bd008e6ad631730120962165c6fa06d7f45956d67a79916b9

MD5 hash:

90a5fc490ad3cbcc42806d626187d156

SHA1 hash:

228b7d4f068a3dd74221c095c6c07996a1832926

Link:

https://www.unpac.me/results/01f7d2b9-ce2d-4df4-ad3b-65959eda7b8b/

SH256 hash:

c1667fa6f6d37044c403c17010f36efc7e08d47ac2fb36a36b3c7e700eb97d81

MD5 hash:

eebb807f8a5a2d47c89648e4fb907f89

SHA1 hash:

35e8cbe02f0ce21492333604056e15bdbc923227

Link:

https://www.unpac.me/results/01f7d2b9-ce2d-4df4-ad3b-65959eda7b8b/

SH256 hash:

09488afe7dbafc325be91621ec686fb5f64f73a780d85892888efdd9e7ac7593

MD5 hash:

80bce4a1e2edd78557a0ae20f3324f64

SHA1 hash:

6ad698dc8a88ef27c8b0a3c6d8810d99e05d378a

Link:

https://www.unpac.me/results/01f7d2b9-ce2d-4df4-ad3b-65959eda7b8b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.66

Link:

https://yomi.yoroi.company/submissions/a9880d363ec81176e27377116d1c8a0771ff8309b51debe1f547e27e91bb823a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.