Extracted

• • Target

    JaffaCakes118_03ba23a85802f57beed2d5c69453c6d2

  • Size

    500KB

  • MD5

    03ba23a85802f57beed2d5c69453c6d2

  • SHA1

    3d83f5623299630fd6f57a567ac048c7d1853dcb

  • SHA256

    39d7b97907b7836d51b332d85ecdbf4cd5fa55de562959a020a6752adeea4e1c

  • SHA512

    028c6edb097565b888589159fb7c8eb92604c333ac58cd075447eb369ae2cd071b85ee0ffdd427ec448fe1b3070adfe26ff5c28482b997a630f8f95b719e2974

  • SSDEEP

    6144:KbCwND4GM89iCb/MN6TeKyzErvWiGJgKJhHgK:Ql4Cbb/MpVKpKJ5gK

  Score

  10^/10

  matiexcollectiondiscoverykeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Matiex family

    matiex

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2