Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1865acf09c474fda853bd7d816584c8427bbfa5d473947d1a773f2b73056b306

  • Size

    1.1MB

  • Sample

    231010-d7x96acf24

  • MD5

    9bfa90128eee28842011defcb81102c6

  • SHA1

    ecde360caaa41f4b6f5029ced9a44ad8e0e8ee4a

  • SHA256

    1865acf09c474fda853bd7d816584c8427bbfa5d473947d1a773f2b73056b306

  • SHA512

    ed3bda34a0cfaf5c7ca43d3b3f47960f9ec107c063862cfeb103ad9e91725603d188fcdbd948528ddb7aaf852dafc5349d62103bd11769c34607cf6c1f2a77ee

  • SSDEEP

    12288:wMrJy90EPffN8EnKHTUW2D2mIiabcLN3yq02B89/u9qpJj+/FjMoDyBuCmtR/s+W:pyLfN8EKApIgLNCnG6GFSup//c8C

Score
10/10
mysticevasionpersistencestealertrojan

Malware Config

Targets

    • Target

      1865acf09c474fda853bd7d816584c8427bbfa5d473947d1a773f2b73056b306

    • Size

      1.1MB

    • MD5

      9bfa90128eee28842011defcb81102c6

    • SHA1

      ecde360caaa41f4b6f5029ced9a44ad8e0e8ee4a

    • SHA256

      1865acf09c474fda853bd7d816584c8427bbfa5d473947d1a773f2b73056b306

    • SHA512

      ed3bda34a0cfaf5c7ca43d3b3f47960f9ec107c063862cfeb103ad9e91725603d188fcdbd948528ddb7aaf852dafc5349d62103bd11769c34607cf6c1f2a77ee

    • SSDEEP

      12288:wMrJy90EPffN8EnKHTUW2D2mIiabcLN3yq02B89/u9qpJj+/FjMoDyBuCmtR/s+W:pyLfN8EKApIgLNCnG6GFSup//c8C

    Score
    10/10
    mysticevasionpersistencestealertrojan

    • Detect Mystic stealer payload

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks