Extracted

• • Target

    fdbab159997e6af6bf0776c48e62c51d_JaffaCakes118

  • Size

    726KB

  • MD5

    fdbab159997e6af6bf0776c48e62c51d

  • SHA1

    4cccfc9467fff9e5fda5ef41bebaef609b1ce889

  • SHA256

    892ac1aad60783b04a388d8cc154f605d9b7b8e3f3f1a7d207072f58f5389c42

  • SHA512

    fee3fb49d5885db08f0b32a551eaaeced72254f736a58e88ba3078a95184957f82036858b222993e1bc121b1733c032e98fb5f690ce02f277ce4c35bd3aaca0c

  • SSDEEP

    12288:q4EqDqf5/HQpEVzAdFFtr8N9ZrydvSgmryVvtF7ye0BMD2Ya/eD+Df:qBq+1x6Frr8N9ZetPLBye0Bk2Yavf

  Score

  10^/10

  matiexcollectiondiscoverykeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2