MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Matiex

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7
SHA3-384 hash:	8ced508a5d155f67a07de8bbbb8e686c0a091c92feb86f0f6b83f2adbf66bf606381b3719742c2697511411bacf9203c
SHA1 hash:	748e44b93cf2882248b2e27c728eb11018984bf4
MD5 hash:	087dfca6f2b2c9825a49d4b986d7f539
humanhash:	muppet-black-green-robert
File name:	NKP210102-NIT-SC2.exe
Download:	download sample
Signature	Matiex Create hunting rule
File size:	797'696 bytes
First seen:	2021-01-14 06:11:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'852 x AgentTesla, 19'779 x Formbook, 12'303 x SnakeKeylogger)
ssdeep	12288:lgvVHZr+7BjD8SOvPXis1eSzJjcOedvsTW8LlQWXJfJ7mtWthnUsciNn4KSiyyjK:KVHEBjDQ119jcjsTW8L6Eut0UsjyKd8
Threatray	18 similar samples on MalwareBazaar
TLSH	5805BF423244CD96E0572BF2146FD46023B57D9F8122C60D3F83BA6B65EB742249BB9F
Reporter	abuse_ch
Tags:	exe Matiex

abuse_ch

Malspam distributing unidentified malware:

HELO: ac697-398.techjera.com
Sending IP: 85.95.240.205
From: Nasr Koujan<info@geniuswho.com>
Reply-To: <sales01@foricco.com>
Subject: Re: Revise Quotaion
Attachment: NKP210102-NIT-SC2.rar (contains "NKP210102-NIT-SC2.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

149

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

NKP210102-NIT-SC2.exe

Verdict:

Malicious activity

Analysis date:

2021-01-14 06:12:36 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/ce10d1b4-6bbf-4af6-9645-eca37f97891f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Matiex

Link:

https://www.capesandbox.com/analysis/111908/

Detection(s):

SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Sending a UDP request

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Creating a file

Using the Windows Management Instrumentation requests

DNS request

Sending an HTTP GET request

Reading critical registry keys

Forced shutdown of a system process

Setting a global event handler for the keyboard

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Threat name:

Matiex

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/580860

Signature

.NET source code contains potential unpacker

Binary contains a suspicious time stamp

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected Matiex Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-01-14 06:12:06 UTC

AV detection:

16 of 46 (34.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v6dctiyxux7hvjmqb5cfzwcvxebkjfoes5sgypxrjbpklkoqe2tq._file

Result

Malware family:

matiex

Score:

10/10

Tags:

family:matiex keylogger stealer

Link:

https://tria.ge/reports/210114-3g7t49t7na/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetThreadContext

Looks up external IP address via web service

Matiex

Matiex Main Payload

Unpacked files

SH256 hash:

af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7

MD5 hash:

087dfca6f2b2c9825a49d4b986d7f539

SHA1 hash:

748e44b93cf2882248b2e27c728eb11018984bf4

Link:

https://www.unpac.me/results/7934999d-e2f6-46e4-b434-65c917a20ea0/

SH256 hash:

c1667fa6f6d37044c403c17010f36efc7e08d47ac2fb36a36b3c7e700eb97d81

MD5 hash:

eebb807f8a5a2d47c89648e4fb907f89

SHA1 hash:

35e8cbe02f0ce21492333604056e15bdbc923227

Link:

https://www.unpac.me/results/7934999d-e2f6-46e4-b434-65c917a20ea0/

SH256 hash:

64a419709ad219ffc006bda776b650da486d55048d2fa34525f40227da0e5c86

MD5 hash:

88c0ec8398978fa2e4240f02765086ad

SHA1 hash:

5a5c4935b2d70e890c89ad9332365f4f4aa86f3c

Link:

https://www.unpac.me/results/7934999d-e2f6-46e4-b434-65c917a20ea0/

SH256 hash:

e40d26c35aad0801e3bdd0f6164fb65ae5c235320ed7d3992cf23778bd53a986

MD5 hash:

1e96ddc2bda0ab4bdbfc53b9c2e1d8ff

SHA1 hash:

6f4e1b45860ec4f316acac58ed1fa09041fa3ce7

Link:

https://www.unpac.me/results/7934999d-e2f6-46e4-b434-65c917a20ea0/

SH256 hash:

73a9d3b80aab146d3bb07699e89b26756f549978d75da152c2664683db2b33b9

MD5 hash:

828ad4ab22128616c20c9af1501a644e

SHA1 hash:

8ae3ff5fffb805d440accf7ddd9db9f08bfa67d0

Link:

https://www.unpac.me/results/7934999d-e2f6-46e4-b434-65c917a20ea0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	MALWARE_Win_Matiex Create hunting rule
Author:	ditekSHen
Description:	Matiex keylogger payload

Rule name:	win_matiex_keylogger_v1 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects the Matiex Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

rar 5497370a1c39741caebb42d33e653266fa0d71810a1cec19aac99931ac81a15e

Matiex

exe af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7

(this sample)

Dropped by

MD5 0626ef6fc6a36ab12410789b3838c8c9

Delivery method

Distributed via e-mail attachment

Dropped by

SHA256 5497370a1c39741caebb42d33e653266fa0d71810a1cec19aac99931ac81a15e

Cape

https://www.capesandbox.com/analysis/111908/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample