Overview

overview

10

Static

static

0908000090000.exe

windows7_x64

10

0908000090000.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3c1114b2db69d8480751fbaac9a517a3d7d4e5cd4d2175771968f9bdd778c42

  • Size

    708KB

  • Sample

    220502-1c217aebap

  • MD5

    88c1fa128e37e9f8775bd79a0c0cb919

  • SHA1

    0a73ccc25e4522236bfdfd9a1f51c1482b05066f

  • SHA256

    e3c1114b2db69d8480751fbaac9a517a3d7d4e5cd4d2175771968f9bdd778c42

  • SHA512

    2ca700c70ac859a87048a8f92bc1b9025d35915c0f0dd2ff62b5a46520f3910710fdcdcacc41a1cc2deaef5c54e05d7ef7c936d697bc4685fc4f9acb5df028f8

Score
10/10
matiexcollectionkeyloggerpersistencespywarestealer

Malware Config

Extracted

Family

matiex

Credentials

  • Protocol:     smtp
  • Host:
    srvc13.turhost.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    italik2015

Targets

    • Target

      0908000090000.exe

    • Size

      3.4MB

    • MD5

      2b16401ac7e40343abde78deb36f0746

    • SHA1

      6c441249071a590f6a1178cc276f87f8641c8cf4

    • SHA256

      315e6e844a325bdbdbd68365d389adb3e31c55cf7323936f14f3e48f7e5f3014

    • SHA512

      3ec8ac63db7b07b9a43b37f27cc80da7543baab0c259e25de2e92cc058427b385d4dc6aa91fc12cdd3b1d6d40c20df1a5c7731ec750a91770f98631c1840a9b8

    Score
    10/10
    matiexcollectionkeyloggerpersistencespywarestealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • Modifies WinLogon for persistence

      persistence

    • Drops startup file

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks