Overview

overview

10

Static

static

3

c6b4a2eb53...9f.exe

windows7-x64

1

c6b4a2eb53...9f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c6b4a2eb53f687988c0427cf752d429f

  • Size

    455KB

  • Sample

    240313-yc13sagb55

  • MD5

    c6b4a2eb53f687988c0427cf752d429f

  • SHA1

    d6b3299043950047524087631f72375b68bfc36d

  • SHA256

    786a583ea35093cc588069ed3b8d4dd6dbe8e9edfe68569d3752c6da82db0de1

  • SHA512

    ded0daa7672ade2aabf1695c67441c0c488b8f44170ebd438105936eeac2a4d9fb7da1aef48565bb42caf6807eb4f0157a0de43ddf4731e5d3c428e8cf034dee

  • SSDEEP

    12288:TdmwkAYHSHrxntq1FM3LIU1pJJpjNc91662/TeIXL:TfzksOCL

Score
10/10
matiexcollectionkeyloggerstealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1718729558:AAFUftnJNVxfQZ7XrIUEpE1UiXHAYPc6VAQ/sendMessage?chat_id=1841930277

Targets

    • Target

      c6b4a2eb53f687988c0427cf752d429f

    • Size

      455KB

    • MD5

      c6b4a2eb53f687988c0427cf752d429f

    • SHA1

      d6b3299043950047524087631f72375b68bfc36d

    • SHA256

      786a583ea35093cc588069ed3b8d4dd6dbe8e9edfe68569d3752c6da82db0de1

    • SHA512

      ded0daa7672ade2aabf1695c67441c0c488b8f44170ebd438105936eeac2a4d9fb7da1aef48565bb42caf6807eb4f0157a0de43ddf4731e5d3c428e8cf034dee

    • SSDEEP

      12288:TdmwkAYHSHrxntq1FM3LIU1pJJpjNc91662/TeIXL:TfzksOCL

    Score
    10/10
    matiexcollectionkeyloggerstealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks