Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1bababe70d37dad8e1ec631237073d7086d164e23b3d37e323d8c817cc9ca2a9

  • Size

    1.2MB

  • Sample

    231008-172nxagd4x

  • MD5

    f332479ac7a5c4a57440f23b530d36d2

  • SHA1

    a11896f34b9884a98bcf381a193ee3be88b48c88

  • SHA256

    1bababe70d37dad8e1ec631237073d7086d164e23b3d37e323d8c817cc9ca2a9

  • SHA512

    8a38fb020893fbb3bcb18c32d532d374c13a6983b50f9a8fa2c8d2ba34717a3c118ec96ccd6005f36b55b3d80466016fe7dbc078bad9e1656eef8809cd5f0cda

  • SSDEEP

    24576:Xyi4GEw3gg2gj29jD3zE4wgD3kUR0YMLg6H5DtCh96:iEEOgg9G9w2MLh5Dtk9

Score
10/10
mysticpersistencestealer

Malware Config

Targets

    • Target

      1bababe70d37dad8e1ec631237073d7086d164e23b3d37e323d8c817cc9ca2a9

    • Size

      1.2MB

    • MD5

      f332479ac7a5c4a57440f23b530d36d2

    • SHA1

      a11896f34b9884a98bcf381a193ee3be88b48c88

    • SHA256

      1bababe70d37dad8e1ec631237073d7086d164e23b3d37e323d8c817cc9ca2a9

    • SHA512

      8a38fb020893fbb3bcb18c32d532d374c13a6983b50f9a8fa2c8d2ba34717a3c118ec96ccd6005f36b55b3d80466016fe7dbc078bad9e1656eef8809cd5f0cda

    • SSDEEP

      24576:Xyi4GEw3gg2gj29jD3zE4wgD3kUR0YMLg6H5DtCh96:iEEOgg9G9w2MLh5Dtk9

    Score
    10/10
    mysticpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks