MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c1a61a6e688452c5bd61bc2dc2779348efb4544f2f5023a62601b41370ccc898. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Matiex
Vendor detections: 6
| SHA256 hash: | c1a61a6e688452c5bd61bc2dc2779348efb4544f2f5023a62601b41370ccc898 |
|---|---|
| SHA3-384 hash: | 0263129f5e4d6bb2b13cea89d571a9688d107cf509657f745d62d17d9b1335d419639bde4e7680ac7985e8782d1d9f7f |
| SHA1 hash: | d166ed6205f4455b356e84c63d5361a3890f4ada |
| MD5 hash: | 3a398a4b69fb1cad1a17e09f36cf6c77 |
| humanhash: | item-cat-robert-juliet |
| File name: | 909000865438 (1).exe |
| Download: | download sample |
| Signature | Matiex |
| File size: | 147'056 bytes |
| First seen: | 2020-10-12 14:49:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 1536:+frcgtvVLnvxH6E0ZovgBfEJjingBiQOCOgfRN+UfX:+frcgtdLnJaE0Zovge4ZCOgf/J |
| Threatray | 5 similar samples on MalwareBazaar |
| TLSH | E0E34F052149FF17CABB01741993C8C926F1A5B3D050C2789DDE8CCCE5B56AA3F9B8E9 |
| Reporter |  abuse_ch |
| Tags: | exe Matiex |
abuse_ch
Malspam distributing unidentified malware:HELO: hosted-by.rootlayer.net
Sending IP: 185.222.57.209
From: financierocvc@gmail.com
Subject: Revised PI/NEW ORDER
Attachment: 909000865438.uu (contains "909000865438 (1).exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
26 / 100
Signature
a
c
d
e
f
g
h
i
L
M
n
o
p
r
s
t
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Backdoor.Androm
Status:
Malicious
First seen:
2020-10-12 10:48:10 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
Result
Malware family:
matiex
Score:
10/10
Tags:
persistence spyware stealer keylogger family:matiex evasion
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Maps connected drives based on registry
Checks BIOS information in registry
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Matiex
Matiex Main Payload
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
c1a61a6e688452c5bd61bc2dc2779348efb4544f2f5023a62601b41370ccc898
MD5 hash:
3a398a4b69fb1cad1a17e09f36cf6c77
SHA1 hash:
d166ed6205f4455b356e84c63d5361a3890f4ada
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.