Extracted

• • Target
    ad5de4499961e24a515b9fdbe6e51d84535983ba6c68ac5d2ceb4708662b5ee8
  • Size 518KB
  • SHA256 ad5de4499961e24a515b9fdbe6e51d84535983ba6c68ac5d2ceb4708662b5ee8
  • MD5 bcab9a4b6d4d884d692b0f42b9c71f9a
  • SHA1 156d66188b34e795099a6c5ff6dd56ec25cac3fc
  • SHA512 8995683354dd4adf765a55a906b837a5c34e8b51cdbfc3981881e19116e1765cbdb75ea623ee822b7d7a18078058e784fd223174bdc28f7ea37675cb589b0537
  • MD5 SHA1 SHA512

  Score

  10^/10

  matiexcollectionevasionkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2