Extracted

• • Target

    b5a3eb26f3d7532eba91ea8122d8045e

  • Size

    1.2MB

  • MD5

    b5a3eb26f3d7532eba91ea8122d8045e

  • SHA1

    f12b2ff14004c73ea99e30dafab805e8dcb17df0

  • SHA256

    0cd342a69ae909916dcb8592e08e92ae6026bd0831179f46c95a8af1bc26e666

  • SHA512

    ba0dbe9a04725ced3f2beef7c27396a80a835c32ed9d4795be3de8a13cf3c4dc4d6b3a30d5668fda5269d9f744f17346bb04c3a10546ac34eab56721cf164965

  • SSDEEP

    24576:2aLZZjhZStXqCFhg+Iu1WVq5J+hu3A8K/dwiGY1iQzB7oaRv/7d5OGQT4wFPuvUf:2mjhZShJgBbnJ

  Score

  10^/10

  matiexcollectionkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2