Overview

overview

10

Static

static

8980000809000.exe

windows7_x64

1

8980000809000.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5135acb4869394c48a11cd709be73b99085c066bb7a664902e96811b7b41a837

  • Size

    210KB

  • Sample

    220503-y3hdcsedfj

  • MD5

    fa5c9db3db2492e6cdb843291ea4ca6e

  • SHA1

    78596ce6e3b747219bf855d828e96e6e4bacc08c

  • SHA256

    5135acb4869394c48a11cd709be73b99085c066bb7a664902e96811b7b41a837

  • SHA512

    f0c9272b6b5761ec745f6cf65dea79c4dc9e330b1f8430050deff325461a26b1ff636e91d334d84fce531dd07a7d1112fa7d19f48d7ef3205c21aff41c916675

Score
10/10
matiexkeyloggerstealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1395392888:AAFrJovDdZICOFB0gX0eGWrAUzEKCRpv8xo/sendMessage?chat_id=1300181783

Targets

    • Target

      8980000809000.COM

    • Size

      619KB

    • MD5

      e04d66f39776231b5b159a053a2b114a

    • SHA1

      c9294ca3bb3401882d1af4d740726deda066e091

    • SHA256

      fbcf45a88ba1f036c2e124ec1939b8e94ffcee01e56e736553938ff4ba5a0dee

    • SHA512

      f965db86ca20748afaafd197ea9c14ed9ad13bad76c33b9300cb81b1db95307421ddb17048550ef118457e9dfd96d2acb93c426447c36c361bed321fbef11c28

    Score
    10/10
    matiexkeyloggerstealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks