Extracted

• • Target

    0ae903ec33ad4f930697e461f869e86410dc4d22cf26de40f5775283c002d971

  • Size

    664KB

  • MD5

    329d395b6edfc1c931bbd0c9dd8b5be5

  • SHA1

    d6cbbeaec3e3571acc01470b01ea4e926e9a4a50

  • SHA256

    0ae903ec33ad4f930697e461f869e86410dc4d22cf26de40f5775283c002d971

  • SHA512

    6ae1fb8aa6dd4fbbf0d70587bbf6ff291514ef33d2b4699d50a9ccac55b692a457a6d94dc7afca611d781d12da47c65c505314faf2015f34141639bcd263bff1

  Score

  10^/10

  matiexcollectionkeyloggerpersistencespywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2