Extracted

• • Target

    48302a0bd757aab1f869f88f8f5c758b

  • Size

    564KB

  • MD5

    48302a0bd757aab1f869f88f8f5c758b

  • SHA1

    db09b74ab6d38967eb2128e986518cd4f06b90aa

  • SHA256

    a3a5dc4d5d1b72c1864dca606a47cf8735a464cdf4d24ec74a113960c128d2c6

  • SHA512

    188a7f195786687efe4559436fbbc71137f8ab11c95e8baa6794cd8ca2d66dfc61d39c0240d9a530ceeb45a2732ad228adb6d96ef4ea13e06df9fb297dbcf438

  • SSDEEP

    12288:hVWX8yg3/V0nQWVrmCmtHLY4FrsASNMNNoZfGIl0rA5:CMyg3Cr8S+fS

  Score

  10^/10

  matiexcollectionkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2