Extracted

• • Target

    61e8144770a3dc3131d70ca446027587_JaffaCakes118

  • Size

    695KB

  • MD5

    61e8144770a3dc3131d70ca446027587

  • SHA1

    c99aaea2aadf8d987c39072b6bba336d6fcdb63e

  • SHA256

    1f06fb381d2055adeb17feb116186867f330e113f24ecff48ccc2c5b702147f5

  • SHA512

    e2d5476873b5678ebab494078cdd6c64f7f5ef21751e106249f5a1c12f77de3f218f44c44ebd7035f09f11597a36b73f93573235e187aff5b792b3462548cfe4

  • SSDEEP

    12288:cfet/a0Yojb641UlLB3F7hxT+zqHWDPsxrWfEF7gUNnb/VIBxWWkc:cfga0Yojb6tLF7hF+zqHWDPsxiEJgUN+

  Score

  10^/10

  matiexcollectioncredential_accessdiscoverykeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2