MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dceee69386ab214661fc1c13d5ee5138a97fc9e3a03516ccb8c29cf7251398a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dceee69386ab214661fc1c13d5ee5138a97fc9e3a03516ccb8c29cf7251398a5
SHA3-384 hash: 7b65089ed637560e1fb774334f7231e403eae6dfcc42d2464c91ba5a737657e674d41d6dc26c9f3912e24eee75583801
SHA1 hash: a557c1d5fe7f78eb21e818e89d71d4f5c9323d60
MD5 hash: fd1c09b00ce1cf87ed3c70d3d3a1f1c8
humanhash: august-saturn-princess-bravo
File name:DEKONT.exe
Download: download sample
Signature Matiex
Create hunting rule
File size:687'104 bytes
First seen:2020-10-27 10:07:49 UTC
Last seen:2020-10-27 12:16:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2dc882656cff9f1571186f39db2b62b3 (1 x Matiex, 1 x Formbook)
ssdeep 12288:cVxiaw9WNKitHVPMrio1cwM070HYHVuJ2p4N4Dz8BtPOIN2AKD0Q8oIiXK36:0+9WRkrr1A0g4HVu012PloAhQbIix
Threatray 47 similar samples on MalwareBazaar
TLSH E2E4E031F240D8F2E427213568F5E535202BBA765A25894F23EA373E4E73392117BD9B
Reporter abuse_ch
Tags:exe geo Matiex TUR


Avatar
abuse_ch
Malspam distributing Matiex:

HELO: server.elmasgrafik.com
Sending IP: 185.48.182.122
From: Administrator <accounts@ri-ca.org>
Reply-To: saleslink@yandex.com
Subject: DEKONT
Attachment: DEKONT.rar (contains "DEKONT.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79776/
Detection(s):
SecuriteInfo.com.ArtemisFD1C09B00CE1.7454.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Using the Windows Management Instrumentation requests
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Launching the process to change network settings
Creating a window
Unauthorized injection to a system process
Result
Threat name:
Matiex
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/513268
Signature
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Sigma detected: MSBuild connects to smtp port
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal WLAN passwords
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Matiex Keylogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dceee69386ab214661fc1c13d5ee5138a97fc9e3a03516ccb8c29cf7251398a5/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 07:08:08 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3txone4gvmqumyp4dqj5l3srhcux7spdua2rntfyykopojittcsq._file
Verdict:
unknown
Similar samples:
5936a9cf8b627e66e6940963743cbf6cadfde89d141ad1fcbefd0b8d6ca23ace
Matiex
651b6664d1612cd3c4ed1c01f42116afd74aeacd10148b3c489ba31d594731ca
Matiex
6989ffe534c2303d7fcc4f5f8b81515a3d30a53ecb395a935bc46391de88b023
Matiex
6fa65eef03e50dbaba9ba7729d7d5f4a24d9302c028ec1640db45d47096ab29d
Matiex
76b5083ce1a34c82e63cded85ecdf767f9d254e99a0d49174fbdd4a449857e41
Matiex
81c1d78fd9c2c4e78b74976875c7ea0ac39ab5c87f5d1671e203c8c05bce01ca
Matiex
92625b5d11e691107b8aa2e733c1be9fe3677b5a86f03e08f239bf6e0d450885
Matiex
ae28aba3d630a1246c0d3675e70237f1289956548f4e24e03a5a19c83579c769
Matiex
d9959e883e5040a3f0b0eeed42e79f42ef2274dc8d00c3f5c4e4161cd7796708
Matiex
deb96dddc557e467d8e3ac9bf5ee8fc167f74461d84e823925c0f8c7b33422e7
Matiex
+ 37 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201027-2y8m98znqn/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserExMod_BedsProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod Beds Protector
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_Matiex
Create hunting rule
Author:ditekSHen
Description:Matiex/XetimaLogger keylogger payload
Rule name:win_matiex_keylogger_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects the Matiex Keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip b6dfdc4fe65881c1ad7044b7c8062fbb074886517af5b2bc207c7f12ad1e9b98

Matiex

Executable exe dceee69386ab214661fc1c13d5ee5138a97fc9e3a03516ccb8c29cf7251398a5

(this sample)

  
Dropped by
MD5 805f7174df87507f68e7ed0b35488a95
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 b6dfdc4fe65881c1ad7044b7c8062fbb074886517af5b2bc207c7f12ad1e9b98
Cape
Cape
https://www.capesandbox.com/analysis/79776/

Comments