Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c802e1c66f8a92f9af63b8dadd61c3b01b681046710b00e891c9717a85f1dbb9

  • Size

    1.2MB

  • Sample

    231007-qwhrjsfa88

  • MD5

    c68dfd5894d92367d2141781dab89968

  • SHA1

    ee4833b833e75d41e8e4b8704b44b7f2200c89b6

  • SHA256

    c802e1c66f8a92f9af63b8dadd61c3b01b681046710b00e891c9717a85f1dbb9

  • SHA512

    6facc49c6126135b5322232eb646f71a5c0e0e8ad58ff99227499164fa776d43c0de85f8d6d04494ca81aadecb40bf30cd8d2f2124474404e666c58f1bd89d6a

  • SSDEEP

    24576:Py/GCieQaYtH+wU/8RVf3nmvQToxkidwz8TSdhprThdwTs:a/GCNQaYV+j/8/mvXkidVGTprS

Score
10/10
mysticpersistencestealer

Malware Config

Targets

    • Target

      c802e1c66f8a92f9af63b8dadd61c3b01b681046710b00e891c9717a85f1dbb9

    • Size

      1.2MB

    • MD5

      c68dfd5894d92367d2141781dab89968

    • SHA1

      ee4833b833e75d41e8e4b8704b44b7f2200c89b6

    • SHA256

      c802e1c66f8a92f9af63b8dadd61c3b01b681046710b00e891c9717a85f1dbb9

    • SHA512

      6facc49c6126135b5322232eb646f71a5c0e0e8ad58ff99227499164fa776d43c0de85f8d6d04494ca81aadecb40bf30cd8d2f2124474404e666c58f1bd89d6a

    • SSDEEP

      24576:Py/GCieQaYtH+wU/8RVf3nmvQToxkidwz8TSdhprThdwTs:a/GCNQaYV+j/8/mvXkidVGTprS

    Score
    10/10
    mysticpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks