Extracted

• • Target

    b02da448441f440e3da47ffe337386a1_JaffaCakes118

  • Size

    704KB

  • MD5

    b02da448441f440e3da47ffe337386a1

  • SHA1

    1a3d5602c8ae752f397ef2bcaf39376338b3ab5f

  • SHA256

    94ed91d33fa5a14f97c31acc659d4600b695920f7df7e79e2a86caf6da8026ff

  • SHA512

    a1df55ada44b08c0b5314880bfea6bd92f82fae65215183b896d419d8ff6c01d11ff5378e500bdd8478adb8bae33175c386e89028e8cf009046858d06919f90f

  • SSDEEP

    12288:4kqPib7Z0NrHVN27x4JxFVt1DE86pLW7pEj71Wjz3rVMNrEZcpYN:4Ta3Z0RYgFRlEdIrVQrEZcpYN

  Score

  10^/10

  matiexcollectionkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2