Overview

overview

10

Static

static

a8fae32665...b6.exe

windows7-x64

10

a8fae32665...b6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8fae326658ce7fb7aa5a3127ee35cb6.exe

  • Size

    558KB

  • Sample

    230102-jqzdsagg91

  • MD5

    a8fae326658ce7fb7aa5a3127ee35cb6

  • SHA1

    6559e08cc97a2ff9bba6906a885307378aad5c03

  • SHA256

    44dceefb44c2ff756c3d9093b69b76dba826ecb55ff6279fe0e519585a6fa342

  • SHA512

    8c272f59e0a8de46275e43cfe7b3e2a3d226f78b77e4102775d3b58cd82cce9a355e9935939275a1f6b80784c09958cacf1b47f2984ae971c81d9a45e50c3f8d

  • SSDEEP

    12288:P9SS0V7xIyeP9I1mKpDPhe950yvCfXU2euRrAMIWmA0lq:1SS0VCFI1n9EnCMB0rpGV

Score
10/10
matiexcollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

Credentials

  • Protocol:     smtp
  • Host:
    mail.zavidovici.ba
  • Port:
    587
  • Username:
    opcina.zavidovici@zavidovici.ba
  • Password:
    12Opc21!

Targets

    • Target

      a8fae326658ce7fb7aa5a3127ee35cb6.exe

    • Size

      558KB

    • MD5

      a8fae326658ce7fb7aa5a3127ee35cb6

    • SHA1

      6559e08cc97a2ff9bba6906a885307378aad5c03

    • SHA256

      44dceefb44c2ff756c3d9093b69b76dba826ecb55ff6279fe0e519585a6fa342

    • SHA512

      8c272f59e0a8de46275e43cfe7b3e2a3d226f78b77e4102775d3b58cd82cce9a355e9935939275a1f6b80784c09958cacf1b47f2984ae971c81d9a45e50c3f8d

    • SSDEEP

      12288:P9SS0V7xIyeP9I1mKpDPhe950yvCfXU2euRrAMIWmA0lq:1SS0VCFI1n9EnCMB0rpGV

    Score
    10/10
    matiexcollectionkeyloggerspywarestealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks