Extracted

Extracted

• • Target
    3345b3680b62996cf0e617dca35459ba8cadd9eacc0cfce472c96e4e2bf1b2ab
  • Size 811KB
  • SHA256 3345b3680b62996cf0e617dca35459ba8cadd9eacc0cfce472c96e4e2bf1b2ab
  • MD5 f7f85f2d85bc9f27dea6901ce759b6a0
  • SHA1 340cb9d1e107ecee278e10943cfc83a3e6f17abf
  • SHA512 b9bdac23032c8706f8095c0def0389630b03141f38534fc73d044e7af4bfd2a8848e359b87a0c0044f621c95c7124f49304d2fb2d724347caac34b05eaa8a0b9
  • MD5 SHA1 SHA512

  Score

  10^/10

  matiexkeyloggerstealercollectionspyware

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2