Overview

overview

10

Static

static

04b390af48...1c.exe

windows7_x64

10

04b390af48...1c.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04b390af484095276bcb7dade5cba01c.exe

  • Size

    723KB

  • Sample

    220116-p4m6kafgcm

  • MD5

    04b390af484095276bcb7dade5cba01c

  • SHA1

    266e539dd3c38ecea6082da852970c98b2dfddbd

  • SHA256

    294b39b41c7e5ee3d4cbab54bcc8c49b8233902f1adfddd70a5e7b6291ed68d3

  • SHA512

    7205ffc2cfc5feab91c462685e0fa781c2bb3ae1857243b2a55800bd18e17fea8b0ae57c157ee8581c95a7b48fa704698cb67d0c976739b1696b019071d55bfc

Score
10/10
matiexcollectionkeyloggerstealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1450189305:AAHfgL7ICb0v3fZSdcIiBztyx0_H-vpllH4/sendMessage?chat_id=1239264370

Targets

    • Target

      04b390af484095276bcb7dade5cba01c.exe

    • Size

      723KB

    • MD5

      04b390af484095276bcb7dade5cba01c

    • SHA1

      266e539dd3c38ecea6082da852970c98b2dfddbd

    • SHA256

      294b39b41c7e5ee3d4cbab54bcc8c49b8233902f1adfddd70a5e7b6291ed68d3

    • SHA512

      7205ffc2cfc5feab91c462685e0fa781c2bb3ae1857243b2a55800bd18e17fea8b0ae57c157ee8581c95a7b48fa704698cb67d0c976739b1696b019071d55bfc

    Score
    10/10
    matiexcollectionkeyloggerstealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks