matiex

General

Target

a1b432f03f0e88407c71b210a5f013ddeff35a1fd7fe36f5fd03808a9474c766
Size

463KB
Sample

220415-be2qrsafe8
MD5

c64e46b8a01abad95b7f9e317778f1da
SHA1

f27d976223aa8bd7bcbc28e59fd2eb75ed33bbb8
SHA256

a1b432f03f0e88407c71b210a5f013ddeff35a1fd7fe36f5fd03808a9474c766
SHA512

6ffe5a9b183a82b088966be5611de20c29ae6c03cfd148d6091e16ce0a7b61a2f64459e2007480c013fbe479588df70ccb500491e70d1b466a8473d6cd58a3c4

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
SMTP.yandex.com
Port:
587
Username:
[email protected]
Password:
yahdera121

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
SMTP.yandex.com
Port:
587
Username:
[email protected]
Password:
yahdera121

Targets

- Target
  
  a1b432f03f0e88407c71b210a5f013ddeff35a1fd7fe36f5fd03808a9474c766
- Size
  
  463KB
- MD5
  
  c64e46b8a01abad95b7f9e317778f1da
- SHA1
  
  f27d976223aa8bd7bcbc28e59fd2eb75ed33bbb8
- SHA256
  
  a1b432f03f0e88407c71b210a5f013ddeff35a1fd7fe36f5fd03808a9474c766
- SHA512
  
  6ffe5a9b183a82b088966be5611de20c29ae6c03cfd148d6091e16ce0a7b61a2f64459e2007480c013fbe479588df70ccb500491e70d1b466a8473d6cd58a3c4
Score

10^/10

matiex collection keylogger spyware stealer metastealer
- Matiex
  Matiex is a keylogger and infostealer first seen in July 2020.
  stealer keylogger matiex
- Matiex Main Payload
- Meta Stealer Stealer
  Meta Stealer steals passwords stored in browsers, written in C++.
  stealer metastealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Matiex Main Payload

Meta Stealer Stealer

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2