Extracted

• • Target

    37472a1bfa5be3fac348e24e3d2e92e4

  • Size

    658KB

  • MD5

    37472a1bfa5be3fac348e24e3d2e92e4

  • SHA1

    0f61f0ab618017cd6122948628d2ff36d274ec27

  • SHA256

    18c491931287787e01064c705c8ae6b7befd908f32989155f6d2f1ee660ed2a6

  • SHA512

    18947f98a6019f34c63e5d8b414184c468bc148989e3c633435550a5db2a46d1c6d4b36b15ac67549085ebe0a05f0f28947995dcdeae23c3a980b88dda2779f8

  • SSDEEP

    6144:B9QA4vedjV+gzjCtJO4BlZixpv+B7/Lr4Jb9pNDRzfdP/1qWADh:LQA8YjV+gPuJDZiV+B7DrwlDRxY5D

  Score

  10^/10

  matiexkeyloggerstealercollectionspyware

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2