Overview

overview

10

Static

static

10

2e11a21dab...e5.exe

windows7-x64

10

2e11a21dab...e5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b368b4f8ba0c292896547adf2a35f967.bin

  • Size

    607KB

  • Sample

    230127-rdj3bsch81

  • MD5

    0d868ac59b9c7371065b1e1545cffa02

  • SHA1

    496ea58690ecca5c7fb97359db017834726519bf

  • SHA256

    fcf88a2b9594d620646487b80ebae20377406fb9e9754b430ae39f768ec1e536

  • SHA512

    a4a8ea1ecb3bc44a4a13e7d1afcfc40c52e1677f54d42dae70955373c997be4371153bf2c84344be9cbc590e91752e660b4ff3415e8c0c3b7518badc88caf9a1

  • SSDEEP

    12288:Np/z3/b+kQv8bpLbg3dBT0NEoGtilsuusWBJB2Ods9/+dDpnaxJFmXkPMi3:Lrb+kyBdt0e5T/M+d5Ri3

Score
10/10
matiexcollectionkeyloggerspywarestealer

Malware Config

Targets

    • Target

      2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe

    • Size

      704KB

    • MD5

      b368b4f8ba0c292896547adf2a35f967

    • SHA1

      02db58020730eb1fb7169c3d4ccc6f17aa3b6037

    • SHA256

      2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5

    • SHA512

      0412f02ee3feb86daca01131d7f7fd52037ed6484edd8188c62eeb9c43db7fa6443d5ce9ed3b9c2daba70cadba8d71badecb6dc2670c85b64a6829e80e194d11

    • SSDEEP

      12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZWpfb:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcN

    Score
    10/10
    matiexcollectionkeyloggerspywarestealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks