Extracted

• • Target
    nigga b nostartupp.exe
  • Size 1.5MB
  • SHA256 da92268cf4a384c5d170d5d4ef9939183328e699c0097bd02b716757a2bc0dde
  • MD5 eef35b609d37962c62bab1df4c0b3c39
  • SHA1 b009a2c43f9a959c72245e07bfbb32ceb8a2473d
  • SHA512 63c54c570a672c2baf246d49e674f55a0b9b51e69db6c7cb8ac4d26ea8b1910e1ada87dc26eaaee13cb3428b9fd06a6277f27db88cf282746a9d9cc5f4d935b5
  • MD5 SHA1 SHA512

  Score

  10^/10

  matiexcollectionevasionkeyloggerstealersuricata

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main Payload

  • suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram

    suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2