Extracted

Extracted

• • Target

    DHL NOTIFICATIONS.exe

  • Size

    1.0MB

  • MD5

    fda57436cff1677823abcfbab88a1d00

  • SHA1

    ee2e5385c1464a13f2c25195fc0cad3218627aba

  • SHA256

    e46dc62cd27ec835359b0acd27569c81a59dde88db8577937774189c2f9a1e57

  • SHA512

    c51fcd9aa2124471ca9f1a649a573f0c1c41eac32fc4307d093d546a8717896a21dfad4f4e18fc304cdaf0ebf30ea83fdfc46bef9f0a2630dd821422f3389966

  Score

  10^/10

  matiexkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2