Extracted

• • Target
    fdbab159997e6af6bf0776c48e62c51d_JaffaCakes118
  • Size 726KB
  • SHA256 892ac1aad60783b04a388d8cc154f605d9b7b8e3f3f1a7d207072f58f5389c42
  • MD5 fdbab159997e6af6bf0776c48e62c51d
  • SHA1 4cccfc9467fff9e5fda5ef41bebaef609b1ce889
  • SHA512 fee3fb49d5885db08f0b32a551eaaeced72254f736a58e88ba3078a95184957f82036858b222993e1bc121b1733c032e98fb5f690ce02f277ce4c35bd3aaca0c
  • SSDEEP 12288:q4EqDqf5/HQpEVzAdFFtr8N9ZrydvSgmryVvtF7ye0BMD2Ya/eD+Df:qBq+1x6Frr8N9ZetPLBye0Bk2Yavf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  matiexcollectiondiscoverykeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2