Extracted

• • Target

    eb5c3f8a581a2bbe778a586697a9b341

  • Size

    870KB

  • MD5

    eb5c3f8a581a2bbe778a586697a9b341

  • SHA1

    4d54306bc2410cece081f1db159665962df9a8da

  • SHA256

    4c65f92cd878c051338bda2ff251c8714d6b7ae2bcea06e73bc954661e993571

  • SHA512

    2878804b5beb838661d983dd7e4ccf48a872a512b4d6260159b3de2fd85d00149869d30a26677500b51b13af6485180441acbdba0a0c7a981c8efb07d4752fc0

  • SSDEEP

    12288:fhv7hZb9YMbf50NQVB2ON9sDJoyVIyeichX/7NDBV9ghPwFy2ewne0:Jtl9fR0eDRsDW/XRNw4FBXe

  Score

  10^/10

  matiexcollectionkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2