General

  • Target

    45c9f027cceb7c97e38df424e4f42fea206981b62ab707c214a24a41bf7fd52d

  • Size

    434KB

  • Sample

    220512-n92qgadge2

  • MD5

    853dbf787fe03b50e3fa1c725412485a

  • SHA1

    770e542ccbdc385a39d41030723e10e5e1cd2795

  • SHA256

    45c9f027cceb7c97e38df424e4f42fea206981b62ab707c214a24a41bf7fd52d

  • SHA512

    68b5956d6a0175ac6192a784f0f31d659b209df48cdf6865f638c15b5f0433ee7ec4e0f3c283d99969c65181f7084e89cdc950ef04f2ae721f1cf5867628b81a

Malware Config

Extracted

Family

matiex

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.porkbun.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    godisable147

Targets

    • Target

      45c9f027cceb7c97e38df424e4f42fea206981b62ab707c214a24a41bf7fd52d

    • Size

      434KB

    • MD5

      853dbf787fe03b50e3fa1c725412485a

    • SHA1

      770e542ccbdc385a39d41030723e10e5e1cd2795

    • SHA256

      45c9f027cceb7c97e38df424e4f42fea206981b62ab707c214a24a41bf7fd52d

    • SHA512

      68b5956d6a0175ac6192a784f0f31d659b209df48cdf6865f638c15b5f0433ee7ec4e0f3c283d99969c65181f7084e89cdc950ef04f2ae721f1cf5867628b81a

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

    • Matiex Main Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks