MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf60e55ec0adb6a2be7a8009c201aecbb074beecd22458bf19ff12f5d5acbb9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Matiex

Vendor detections: 11

Intelligence 11 IOCs YARA 5 File information Comments

SHA256 hash:	bf60e55ec0adb6a2be7a8009c201aecbb074beecd22458bf19ff12f5d5acbb9b
SHA3-384 hash:	331be1a6c93dbbc7b6fccb736dce567f8acb835554aff587c18cf1d056750f498707b2b2ed8974220b172bcf30f1cfcf
SHA1 hash:	d7e609b5629b33f663f21ba0e5540ae66ae097c4
MD5 hash:	89a16b7a33c0399e5622950068007d4f
humanhash:	butter-venus-may-hamper
File name:	M0890068899998.exe
Download:	download sample
Signature	Matiex Create hunting rule
File size:	552'448 bytes
First seen:	2020-12-18 09:27:58 UTC
Last seen:	2020-12-18 11:35:00 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ec6b5d5d84c70287e82bee260d5a763f (3 x Matiex, 1 x SnakeKeylogger)
ssdeep	12288:P9SS0V7xIyeP9I1mKpDPhe950yvCfXU2euRrAMIWmA0lS:1SS0VCFI1n9EnCMB0rpGVS
Threatray	189 similar samples on MalwareBazaar
TLSH	E4C4235D2E113D74EAD24A38CC02B872A688090B8D97438BC8DB6FD5C1899577BD1BFD
Reporter	abuse_ch
Tags:	exe Matiex

abuse_ch

Malspam distributing Matiex:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: ventas@fasemex.com.mx
Subject: NUEVO PEDIDO # 090800
Attachment: 0900S890000.zip (contains "M0890068899998.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

M0890068899998.exe

Verdict:

Malicious activity

Analysis date:

2020-12-18 10:10:52 UTC

Tags:

evasion trojan 404keylogger stealer

Link:

https://app.any.run/tasks/43bced9d-b3bd-411c-b02d-0f081ba22e27

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Matiex

Link:

https://www.capesandbox.com/analysis/108364/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.35756486.14971.8821.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Creating a file

Running batch commands

Modifying an executable file

Launching a process

Sending a UDP request

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Matiex

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/566135

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal WLAN passwords

Tries to steal Mail credentials (via file access)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Matiex Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf60e55ec0adb6a2be7a8009c201aecbb074beecd22458bf19ff12f5d5acbb9b/

Threat name:

Win32.Trojan.Zenpak

Status:

Malicious

First seen:

2020-12-17 13:56:14 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=x5qokxwavw3kfpt2qae4eanozoyhjpxm2isfrpyz74jplvnmxonq._file

Verdict:

malicious

Result

Malware family:

matiex

Score:

10/10

Tags:

family:matiex keylogger spyware stealer

Link:

https://tria.ge/reports/201218-lxlk3nhyys/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Matiex

Matiex Main Payload

Unpacked files

SH256 hash:

739d57eba09e63f470ef944119726c57234f2fbaef4eb79c61326b5789b2239d

MD5 hash:

0b65103e46ffc6bba02dd3e381455c56

SHA1 hash:

a385d6509cd86e7f299a91c1415a36ef9c5a8f01

Link:

https://www.unpac.me/results/0e90b908-a8bd-4b5a-a907-b453c41889ac/

SH256 hash:

50e2021a1f898767d381b0ff20f71cf6fe854e4411398b307c6eda39dbbdc5dc

MD5 hash:

d52d9308a35e49150226ab76f6430e24

SHA1 hash:

2261d4ef3e481e04e93e37befa328d69fb5ea7da

Link:

https://www.unpac.me/results/0e90b908-a8bd-4b5a-a907-b453c41889ac/

SH256 hash:

c1667fa6f6d37044c403c17010f36efc7e08d47ac2fb36a36b3c7e700eb97d81

MD5 hash:

eebb807f8a5a2d47c89648e4fb907f89

SHA1 hash:

35e8cbe02f0ce21492333604056e15bdbc923227

Link:

https://www.unpac.me/results/0e90b908-a8bd-4b5a-a907-b453c41889ac/

SH256 hash:

a23918d6e582c123140d76477e7e211e11eab5cbfad5879a032c534d570e2325

MD5 hash:

d8bc528b895537f52c9564f2ffc9797e

SHA1 hash:

f2641755f8523aff9ac614d393353cb0dd9d65d0

Link:

https://www.unpac.me/results/0e90b908-a8bd-4b5a-a907-b453c41889ac/

SH256 hash:

bf60e55ec0adb6a2be7a8009c201aecbb074beecd22458bf19ff12f5d5acbb9b

MD5 hash:

89a16b7a33c0399e5622950068007d4f

SHA1 hash:

d7e609b5629b33f663f21ba0e5540ae66ae097c4

Link:

https://www.unpac.me/results/0e90b908-a8bd-4b5a-a907-b453c41889ac/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Virus

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bf60e55ec0adb6a2be7a8009c201aecbb074beecd22458bf19ff12f5d5acbb9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod Beds Protector

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	MALWARE_Win_Matiex Create hunting rule
Author:	ditekshen
Description:	Matiex keylogger payload

Rule name:	win_matiex_keylogger_v1 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects the Matiex Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip 35179778958fe523ba324a706da15ddf578c27432ea36436b6c8f496e030ae6c

Matiex

exe bf60e55ec0adb6a2be7a8009c201aecbb074beecd22458bf19ff12f5d5acbb9b

(this sample)

Dropped by

MD5 de9257cf2825bbf215efca5ade5ce709

Delivery method

Distributed via e-mail attachment

Dropped by

SHA256 35179778958fe523ba324a706da15ddf578c27432ea36436b6c8f496e030ae6c

Cape

https://www.capesandbox.com/analysis/108364/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample