MatIEx

Matiex is a Windows-based .NET keylogger and information-stealing malware sold on underground forums as a commodity malware offering. It has been marketed with multiple operator-friendly features, including configurable installation behavior, startup persistence, self-removal, and several exfiltration options. The malware is associated with the broader ecosystem of commodity .NET stealers and keyloggers, and multiple analyses have noted strong code and architectural similarities between Matiex and Snake Keylogger, with some reporting that Snake likely shares a common code base or may have evolved from Matiex. Matiex has also appeared as a payload in phishing-delivered malware campaigns alongside other commodity stealers such as Agent Tesla, FormBook, Azorult, and njRat.

Matiex is designed primarily for surveillance and theft of user data. Reported capabilities include Unicode keystroke logging, clipboard capture, screenshot collection, microphone recording, password and sensitive-data theft from more than 60 browsers, victim IP discovery, and remote upload of stolen information. Exfiltration channels advertised or observed for Matiex include FTP, SMTP or email, Telegram, Discord, and in some reporting HTTP. The malware also supports persistence on Windows through startup mechanisms and includes a self-destruction feature intended to remove the malware after an operation is complete. Some reporting indicates support for binder-style execution, allowing the malware to be packaged with other files so it runs when those files are opened.

Observed delivery has included spam email carrying malicious attachments, including archive files masquerading as legitimate content. Matiex has also been identified as a final payload in broader phishing campaigns using malicious Office documents and staged droppers. Its packaging, sales model, and support structure are consistent with malware-as-a-service commercialization aimed at a wide range of criminal operators rather than a narrowly targeted intrusion set.