Overview

overview

10

Static

static

Required O...99.exe

windows7_x64

10

Required O...99.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Required Order Details 0099299.exe

  • Size

    1.1MB

  • Sample

    210724-9fp1yzvrfa

  • MD5

    3bcae8c41a076a0803c99fea75f2aa87

  • SHA1

    f2c1b01afcc3a3af6d947b39419bb4531daa8945

  • SHA256

    42ff1648e53d0054bc7c4a5c8a5db648c2a3405415d441c7d5801e52f56bf7a7

  • SHA512

    220880b1422811db1d9cd79030ea8005a7921ecabb580a3ed537d68bb068005f98b14a87e1f90f796d0d506ccd37675c9153a84e2ea0096bc45d55534f5e4113

Score
10/10
matiexkeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

Credentials

  • Protocol:     smtp
  • Host:
    mail.thts.vn
  • Port:
    25
  • Username:
    sales01@mtlvn.com.vn
  • Password:
    123luongngan1989

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.thts.vn
  • Port:
    25
  • Username:
    sales01@mtlvn.com.vn
  • Password:
    123luongngan1989

Targets

    • Target

      Required Order Details 0099299.exe

    • Size

      1.1MB

    • MD5

      3bcae8c41a076a0803c99fea75f2aa87

    • SHA1

      f2c1b01afcc3a3af6d947b39419bb4531daa8945

    • SHA256

      42ff1648e53d0054bc7c4a5c8a5db648c2a3405415d441c7d5801e52f56bf7a7

    • SHA512

      220880b1422811db1d9cd79030ea8005a7921ecabb580a3ed537d68bb068005f98b14a87e1f90f796d0d506ccd37675c9153a84e2ea0096bc45d55534f5e4113

    Score
    10/10
    matiexkeyloggerspywarestealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks