General
-
Target
b368b4f8ba0c292896547adf2a35f967.bin
-
Size
607KB
-
Sample
230127-rdj3bsch81
-
MD5
0d868ac59b9c7371065b1e1545cffa02
-
SHA1
496ea58690ecca5c7fb97359db017834726519bf
-
SHA256
fcf88a2b9594d620646487b80ebae20377406fb9e9754b430ae39f768ec1e536
-
SHA512
a4a8ea1ecb3bc44a4a13e7d1afcfc40c52e1677f54d42dae70955373c997be4371153bf2c84344be9cbc590e91752e660b4ff3415e8c0c3b7518badc88caf9a1
-
SSDEEP
12288:Np/z3/b+kQv8bpLbg3dBT0NEoGtilsuusWBJB2Ods9/+dDpnaxJFmXkPMi3:Lrb+kyBdt0e5T/M+d5Ri3
Malware Config
Targets
-
-
Target
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe
-
Size
704KB
-
MD5
b368b4f8ba0c292896547adf2a35f967
-
SHA1
02db58020730eb1fb7169c3d4ccc6f17aa3b6037
-
SHA256
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5
-
SHA512
0412f02ee3feb86daca01131d7f7fd52037ed6484edd8188c62eeb9c43db7fa6443d5ce9ed3b9c2daba70cadba8d71badecb6dc2670c85b64a6829e80e194d11
-
SSDEEP
12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZWpfb:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcN
Score10/10-
Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
-
Matiex Main payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-