Extracted

• • Target

    Cosmetic product_list_2023_Quatation.Approved.by.CEO.xls.lnk

  • Size

    2KB

  • MD5

    f9c403c1c4b55521d5cb06bf5232ca0e

  • SHA1

    6f2cd23f0c816475dcbdbc60039c0aa7252a98fd

  • SHA256

    716d31755f09d102d83a35276c9c6422c490757eb7c62f9e39a3263ba6057267

  • SHA512

    4efcf9f6bf488295c3be1fcf819e618417d86d68125e2bb5d5ac86a8bdcc46d39b0da4276fac787e1881e4d228d64dd4e4bc7dd17dda34351196a59889d28af5

  Score

  10^/10

  darkgatemysticspywarestealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2