Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Cu8lr9EP.exe

  • Size

    1.5MB

  • Sample

    231006-e6nj1aha4v

  • MD5

    a40b80b9f9fe39308c0f10b152d4a715

  • SHA1

    04437d394376e70d5382e5d2e1e6e83b189ba21e

  • SHA256

    05e973761e44463f832a1d02a7ef7615686bfee5d9cf3d585c1c8f51b9d8a2d4

  • SHA512

    f12605a016ff14981bad6af43909aed27a9487f0a5841e63fddaa33f4b4dfb6d50b71bbd47132e7c84c7f62562d4ac4f5544bbf5ca6a027b142b5cadec793f86

  • SSDEEP

    24576:NyK+MXsdOLiQO3B/X8kt7YOzz4dBLcKPggKF83zfpJ5X2CBd8rA:oK+MXsdOcR/RSw4o23zRYr

Score
10/10
mysticpersistencestealer

Malware Config

Targets

    • Target

      Cu8lr9EP.exe

    • Size

      1.5MB

    • MD5

      a40b80b9f9fe39308c0f10b152d4a715

    • SHA1

      04437d394376e70d5382e5d2e1e6e83b189ba21e

    • SHA256

      05e973761e44463f832a1d02a7ef7615686bfee5d9cf3d585c1c8f51b9d8a2d4

    • SHA512

      f12605a016ff14981bad6af43909aed27a9487f0a5841e63fddaa33f4b4dfb6d50b71bbd47132e7c84c7f62562d4ac4f5544bbf5ca6a027b142b5cadec793f86

    • SSDEEP

      24576:NyK+MXsdOLiQO3B/X8kt7YOzz4dBLcKPggKF83zfpJ5X2CBd8rA:oK+MXsdOcR/RSw4o23zRYr

    Score
    10/10
    mysticpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks