MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1f6a0b698c957d92bc86fdaf9add81405fc26c716f691fb34148485a93de97c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Matiex

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	e1f6a0b698c957d92bc86fdaf9add81405fc26c716f691fb34148485a93de97c
SHA3-384 hash:	5bfce70c84999ac75a79d0e354427bb733aca7704b6a5221ceb6ddbc944a173dd7754a3da681ebdebfcc87442f476080
SHA1 hash:	3ca264ffe003d0a1c3b196169ed5cf672b3b1794
MD5 hash:	ac9577cdc33e7cf5cd3193d9a02b5ee6
humanhash:	thirteen-solar-montana-cardinal
File name:	gsxp5mkd0ACsDub.exe
Download:	download sample
Signature	Matiex Create hunting rule
File size:	972'288 bytes
First seen:	2020-10-19 10:52:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	12288:5xaJRGGS9veak8xmrrUFoWs59A1GKZHNYPzodGz:5lpxzFo7LA1GUKzodG
TLSH	3A25381073F80B59F43B57F5963860419B767A5A512EC20C7D9E31DE9FB2B020AA3B27
Reporter	abuse_ch
Tags:	exe geo Halkbank Matiex TUR

abuse_ch

Malspam distributing unidentified malware:

HELO: server.elmasgrafik.com
Sending IP: 185.48.182.122
From: financierocvc@gmail.com
Reply-To: halkbank.e-ekstre@halkbank.com.tr
Subject: DEKONT
Attachment: gsxp5mkd0ACsDub.zip (contains "gsxp5mkd0ACsDub.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

110

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72914/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Using the Windows Management Instrumentation requests

Creating a file

Result

Threat name:

Matiex

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/495301

Signature

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Capture Wi-Fi password

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal WLAN passwords

Tries to steal Mail credentials (via file access)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Yara detected AntiVM_3

Yara detected Matiex Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e1f6a0b698c957d92bc86fdaf9add81405fc26c716f691fb34148485a93de97c/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-10-19 08:16:45 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4h3kbnuyzfl5sk6in7nptloycqc7yjwhc33jd6zucscilkj55f6a._file

Result

Malware family:

matiex

Score:

10/10

Tags:

stealer keylogger family:matiex evasion

Link:

https://tria.ge/reports/201019-s2xc94mkt2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Maps connected drives based on registry

Checks BIOS information in registry

Looks for VMWare Tools registry key

Looks for VirtualBox Guest Additions in registry

Matiex

Matiex Main Payload

Unpacked files

SH256 hash:

e1f6a0b698c957d92bc86fdaf9add81405fc26c716f691fb34148485a93de97c

MD5 hash:

ac9577cdc33e7cf5cd3193d9a02b5ee6

SHA1 hash:

3ca264ffe003d0a1c3b196169ed5cf672b3b1794

Link:

https://www.unpac.me/results/b6dccbcc-1d6f-45ef-b8c0-f62f041408f2/

SH256 hash:

31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b

MD5 hash:

0aebe46040ceb011e78506d4985fe3de

SHA1 hash:

218ac1e7b14a66c604ec3042f8486bed9cd4c2c1

Link:

https://www.unpac.me/results/b6dccbcc-1d6f-45ef-b8c0-f62f041408f2/

SH256 hash:

c1667fa6f6d37044c403c17010f36efc7e08d47ac2fb36a36b3c7e700eb97d81

MD5 hash:

eebb807f8a5a2d47c89648e4fb907f89

SHA1 hash:

35e8cbe02f0ce21492333604056e15bdbc923227

Link:

https://www.unpac.me/results/b6dccbcc-1d6f-45ef-b8c0-f62f041408f2/

SH256 hash:

76035ffcb8847a0e38add2538c9c684fd51ecf80c9216f09dbae4f7bb8b84cbb

MD5 hash:

0071a3b38a38a99502cd9a565199b9e9

SHA1 hash:

6cacb8151c749c2bfd3e2aea7ed1c50c6e548c7d

Link:

https://www.unpac.me/results/b6dccbcc-1d6f-45ef-b8c0-f62f041408f2/

SH256 hash:

b8a5924ea4919721433b41ad6be8e72842ad0d5b4c2ef692681bd9f4a6a055d5

MD5 hash:

2bd833dc44be912eb7a8ff1473f032f0

SHA1 hash:

a6fdbee496e5d94087aad5262ee6f0f0bd530a73

Link:

https://www.unpac.me/results/b6dccbcc-1d6f-45ef-b8c0-f62f041408f2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e1f6a0b698c957d92bc86fdaf9add81405fc26c716f691fb34148485a93de97c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.