Extracted

• • Target
    40b14cd99109b91284625b00a4a8445e_JaffaCakes118
  • Size 703KB
  • SHA256 18dca52ce50cdf148ca233fb83cd2c3e3c7b39a9ac254c96ac374ae63eb8f44c
  • MD5 40b14cd99109b91284625b00a4a8445e
  • SHA1 c5d15cbc8954e0d69f19aceb6b2a62231bb65636
  • SHA512 6eafa9647c6fcfe9a28708b14f42f01f94e717fe656a46c924527363a6b5287d8876d8e393930557ec19d4b581df4dd38de5a056ec96f36bfb34512dbe327f69
  • SSDEEP 12288:0w4zjXcPq/JmHLgmG9qrqnABk3CUQPlOVwCGZbvRyaYe85QC0SbHYZjyHFOGExwN:Crzh2//rgrYo5Dlpnks3ExwN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  matiexcollectionkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2