Overview

overview

10

Static

static

3

0b52424adb...18.exe

windows10-2004-x64

10

0b52424adb...18.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    matiex.zip
  • Size 472KB
  • Sample260427-e31edsew5k
  • SHA256 84fee1e1bbd2269553ce335265d9c2ee25be3e2fbe064399d6a24ae74fcce605
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
matiexcollectioncredential_accessdiscoverykeyloggerspywarestealer

Malware Config

Extracted

Family

  • matiex

C2

  • https://api.telegram.org/bot1327331385:AAFaAF38_aAo1cyYYTIEnuc9sIJxwBlO_i4/sendMessage?chat_id=1055082792

Targets

    • Target
      0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118
    • Size 715KB
    • SHA256 0ed96cf4589be7b6b9b9562a165f4587ecf61e70a4958fb524f75c8b7c0b3fc9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectioncredential_accessdiscoverymatiexkeyloggerspywarestealer

    • Family: Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks