Overview

overview

10

Static

static

3

61e8144770...18.exe

windows7-x64

10

61e8144770...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61e8144770a3dc3131d70ca446027587_JaffaCakes118

  • Size

    695KB

  • Sample

    240729-1hgbns1hpr

  • MD5

    61e8144770a3dc3131d70ca446027587

  • SHA1

    c99aaea2aadf8d987c39072b6bba336d6fcdb63e

  • SHA256

    1f06fb381d2055adeb17feb116186867f330e113f24ecff48ccc2c5b702147f5

  • SHA512

    e2d5476873b5678ebab494078cdd6c64f7f5ef21751e106249f5a1c12f77de3f218f44c44ebd7035f09f11597a36b73f93573235e187aff5b792b3462548cfe4

  • SSDEEP

    12288:cfet/a0Yojb641UlLB3F7hxT+zqHWDPsxrWfEF7gUNnb/VIBxWWkc:cfga0Yojb6tLF7hF+zqHWDPsxiEJgUN+

Score
10/10
matiexcollectioncredential_accessdiscoverykeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

Credentials

  • Protocol:     smtp
  • Host:
    ebop.website
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    P@ssw0rdP@ssw0rd

Targets

    • Target

      61e8144770a3dc3131d70ca446027587_JaffaCakes118

    • Size

      695KB

    • MD5

      61e8144770a3dc3131d70ca446027587

    • SHA1

      c99aaea2aadf8d987c39072b6bba336d6fcdb63e

    • SHA256

      1f06fb381d2055adeb17feb116186867f330e113f24ecff48ccc2c5b702147f5

    • SHA512

      e2d5476873b5678ebab494078cdd6c64f7f5ef21751e106249f5a1c12f77de3f218f44c44ebd7035f09f11597a36b73f93573235e187aff5b792b3462548cfe4

    • SSDEEP

      12288:cfet/a0Yojb641UlLB3F7hxT+zqHWDPsxrWfEF7gUNnb/VIBxWWkc:cfga0Yojb6tLF7hF+zqHWDPsxiEJgUN+

    Score
    10/10
    matiexcollectioncredential_accessdiscoverykeyloggerspywarestealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks