Extracted

• • Target

    0049113ba9bdda6201ac9ca225b8a224_JaffaCakes118

  • Size

    692KB

  • MD5

    0049113ba9bdda6201ac9ca225b8a224

  • SHA1

    34c73e9ce5bfb82e09c35906139dd06f716cb475

  • SHA256

    4f180b0d01bfd9ebecfc92f5268f10a80562bfdbaaaa3baf35ec91dd44a65643

  • SHA512

    cc0a558ce63adf2105ee89c45e9794d5586b90eef1617bcda6b17c743fd6410f801987be0cd3957a19d668cb3f36a82c5fc767f51aa6195db4726150e93f6380

  • SSDEEP

    12288:9StygfdP/9pP2tLBY6STjRyLwycgP+pITEQA6lM8x34Na497EttGNgIa:9SZfdX9J2JBqPRcwWP+6ZX2

  Score

  10^/10

  discoverymatiexcollectioncredential_accesskeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2