Last seven days
- First activity
- Jul 23, 2026
- Last activity
- Jul 23, 2026
- Feed role
- C2
- Host form
- 1 IP / 0 hostnames
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Jul 22
Observed infrastructure
Leading locations
- ID1
Leading providers
- Wave Broadband1
Samples
Recent associated samples
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce Observed Jul 23, 2026Triage
47169c00735dc8287955be416ea9f3ba9b6d8a8586b25b789370a96531883d8d Observed Jul 23, 2026Triage
4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1 Observed Jul 23, 2026Triage
54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3 Observed Jul 23, 2026Triage
738eacc140159cd81dff41dd16c806eb7c0c8391c256f1738d75d0321f77ba2e Observed Jul 23, 2026Triage
MITRE ATT&CK
MatIEx in ATT&CK
2 distinct techniquesTechniques
2 techniquesReporting
Research mentioning MatIEx
Nov 17
Rexorvc0
Snake Evolution | RexorVc0
It first appeared in 2019 and it is believed that much of the source code may belong to Matiex, while others maintain that 404 was first and that Matiex obtained its code.
Mar 25
Mandiant Threat Intelligence
Don't @ Me: URL Obfuscation Through Schema Abuse | Mandiant | Google Cloud Blog
Appendix 2: Malware Families By URL MATIEX hxxp://...@104.168.32.152/O__O.DOC
