Extracted

• • Target
    New Order - Avicorp Middle East.exe
  • Size 730KB
  • SHA256 5ed1ca31300cdef81d6bbbba39924b2a6b163d49a124f6f0a3bc997b122aba62
  • MD5 a049a1ba8f02643309f08baae4fc05b3
  • SHA1 6dc3536902de41881b128f9e2506599d0063d355
  • SHA512 533793c1196983ee3aaaedc238ea575039e0eff1fe9580a50d73e00da3a25caa903c51bb20a3f3e96567ffc6e21eedeee64536141a4cc205340f069d83babc8a
  • SSDEEP 6144:RppZaEHpEnOISylvdar7YY6/oJhc4boXYI8edrbmUm/4O8b8ITDnlznZDG0:PJxVn6/onTiYaBbvm/4O8b8ITDnl
  • TLSH
    T102F4B43262F9C2C0C1647576CD67BAF02251ED96C9A08E0F3D4A7F597A722A0FD3960D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmatiexkeyloggerpersistencestealer

  • Family: Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2