Extracted

• • Target
    0908000090000.exe
  • Size 3.4MB
  • SHA256 315e6e844a325bdbdbd68365d389adb3e31c55cf7323936f14f3e48f7e5f3014
  • MD5 2b16401ac7e40343abde78deb36f0746
  • SHA1 6c441249071a590f6a1178cc276f87f8641c8cf4
  • SHA512 3ec8ac63db7b07b9a43b37f27cc80da7543baab0c259e25de2e92cc058427b385d4dc6aa91fc12cdd3b1d6d40c20df1a5c7731ec750a91770f98631c1840a9b8
  • MD5 SHA1 SHA512

  Score

  10^/10

  matiexcollectionkeyloggerpersistencespywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main Payload

  • Modifies WinLogon for persistence

    persistence

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2