Extracted

Extracted

• • Target
    PROFORMA INVOICE.PDF......exe
  • Size 567KB
  • SHA256 b353a8a7967d9d72d358e29044f725e3f359c5fc8aebd0dba84d13701ccfdfac
  • MD5 a9ceffb0c01ef7b2d56aead65b433529
  • SHA1 d3577bc9782c8be92cf86a4ba1b7a9becf3ec1a9
  • SHA512 3dea0df1d7edf80f4d8edeb0755bfc488df7a5890e492a2adca99b145812fa3f3634696467bb7788b1ae61749f5045a4a4d19284c2120aa3bd9bffaa8ae342d3
  • MD5 SHA1 SHA512

  Score

  10^/10

  matiexkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2