Overview

overview

10

Static

static

3

36e2aeb301...18.exe

windows7-x64

10

36e2aeb301...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36e2aeb30102a06a4f2604140e273afc_JaffaCakes118

  • Size

    727KB

  • Sample

    240729-edxbfawdpd

  • MD5

    36e2aeb30102a06a4f2604140e273afc

  • SHA1

    e0af9024e33c8ce73624a4aa1dcf49cb2f49b2fd

  • SHA256

    dcc9ebbfe48ee7e19ca98d1a6f8232c17cb35618bcb654e32bcffda87166c22b

  • SHA512

    61df3c81e305e7f49bc2682ae874dc160ea302ee311f8955a5b2e939198fbe976b431b104021c37b5dfe994d390193c7de8215de2803a5f66a3b7ea2f2b6abb4

  • SSDEEP

    12288:Z9ZQhqP8e9sJEtbDgT4/stKVXFOBTJqv71AebFsV0NZtj8nAUXh5K:Z9ShqPFUestKVVITJMhnbFsVor6X

Score
10/10
matiexcollectioncredential_accessdiscoverykeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

Credentials

Targets

    • Target

      36e2aeb30102a06a4f2604140e273afc_JaffaCakes118

    • Size

      727KB

    • MD5

      36e2aeb30102a06a4f2604140e273afc

    • SHA1

      e0af9024e33c8ce73624a4aa1dcf49cb2f49b2fd

    • SHA256

      dcc9ebbfe48ee7e19ca98d1a6f8232c17cb35618bcb654e32bcffda87166c22b

    • SHA512

      61df3c81e305e7f49bc2682ae874dc160ea302ee311f8955a5b2e939198fbe976b431b104021c37b5dfe994d390193c7de8215de2803a5f66a3b7ea2f2b6abb4

    • SSDEEP

      12288:Z9ZQhqP8e9sJEtbDgT4/stKVXFOBTJqv71AebFsV0NZtj8nAUXh5K:Z9ShqPFUestKVVITJMhnbFsVor6X

    Score
    10/10
    matiexcollectioncredential_accessdiscoverykeyloggerspywarestealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks