Overview

overview

10

Static

static

98nMUVIMa7yoxmF.exe

windows7_x64

10

98nMUVIMa7yoxmF.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98nMUVIMa7yoxmF.exe

  • Size

    1.2MB

  • Sample

    220125-x9h3ssdebq

  • MD5

    a060e6b79f24c737ed87a315cfb02760

  • SHA1

    6e28de0375a2a8431ebf17e8858e8a5a32e5358f

  • SHA256

    962a2c242f1491057e2192083e69c7a4f06be6e37a2ceb85ba43f66fd21a80c3

  • SHA512

    483729e2bd5c2118d2abc81fb4d469023c372e00f2d9056d68e03c8db6200f9ea83f9a32fb73131784e292b92885c893611d2d199253e4f596ae19aa62908e95

Score
10/10
matiexcollectionkeyloggerspywarestealersuricata

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1769394961:AAF5BB35akL859CwVaXypIqpVsGWlaKvi7A/sendMessage?chat_id=1735544933

Targets

    • Target

      98nMUVIMa7yoxmF.exe

    • Size

      1.2MB

    • MD5

      a060e6b79f24c737ed87a315cfb02760

    • SHA1

      6e28de0375a2a8431ebf17e8858e8a5a32e5358f

    • SHA256

      962a2c242f1491057e2192083e69c7a4f06be6e37a2ceb85ba43f66fd21a80c3

    • SHA512

      483729e2bd5c2118d2abc81fb4d469023c372e00f2d9056d68e03c8db6200f9ea83f9a32fb73131784e292b92885c893611d2d199253e4f596ae19aa62908e95

    Score
    10/10
    matiexcollectionkeyloggerspywarestealersuricata

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram

      suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram

      suricata

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks