General

  • Target

    d92555bcd56ec92060ad31e69cdad855.exe

  • Size

    177KB

  • Sample

    211227-t1c9eabdcl

  • MD5

    d92555bcd56ec92060ad31e69cdad855

  • SHA1

    a9e23881ce5f209ec5b323d546a498ab64233249

  • SHA256

    b3252b9c8261e4b2d07f31c71dc1c3f0e2032a0fd5aa53ced919e5db104369e6

  • SHA512

    c3040d9f91f7976dec23f64a4bebaf11279149e8c765859e7469dae7e7406316516fc9d4d76d57639ee6ebb0d26720379c52c60f7adb3b7fe390f41d509c92aa

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    kerekesfoto.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    5ae6LgwJ7rYj

Targets

    • Target

      d92555bcd56ec92060ad31e69cdad855.exe

    • Size

      177KB

    • MD5

      d92555bcd56ec92060ad31e69cdad855

    • SHA1

      a9e23881ce5f209ec5b323d546a498ab64233249

    • SHA256

      b3252b9c8261e4b2d07f31c71dc1c3f0e2032a0fd5aa53ced919e5db104369e6

    • SHA512

      c3040d9f91f7976dec23f64a4bebaf11279149e8c765859e7469dae7e7406316516fc9d4d76d57639ee6ebb0d26720379c52c60f7adb3b7fe390f41d509c92aa

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

    • Matiex Main Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks