Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Jq3QO20.exe

  • Size

    656KB

  • Sample

    231113-lgwyeabh2s

  • MD5

    07305c9be8c5b783b988a088ae04b78b

  • SHA1

    20fbf7549a5f25104e6978686a02893f047a7cad

  • SHA256

    bc6f0aeb3a9a512252787af9df31838f9d402b8c4c6341555495d222d0d0ce58

  • SHA512

    9043cfd3f05e2d21b81298c1246ad470c01b01b130c64d0f30d59fbe87274b48dcf377e8a583f640c74e678cd3e4e704b7e33a1ae17d7d44022f20e1e28357b0

  • SSDEEP

    12288:DMroy90D0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6SVh4+je6/Oct:DyQiaaewIsgCQGIgYDehpvt

Score
10/10
mysticgooglepaypalpersistencephishingstealer

Malware Config

Targets

    • Target

      Jq3QO20.exe

    • Size

      656KB

    • MD5

      07305c9be8c5b783b988a088ae04b78b

    • SHA1

      20fbf7549a5f25104e6978686a02893f047a7cad

    • SHA256

      bc6f0aeb3a9a512252787af9df31838f9d402b8c4c6341555495d222d0d0ce58

    • SHA512

      9043cfd3f05e2d21b81298c1246ad470c01b01b130c64d0f30d59fbe87274b48dcf377e8a583f640c74e678cd3e4e704b7e33a1ae17d7d44022f20e1e28357b0

    • SSDEEP

      12288:DMroy90D0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6SVh4+je6/Oct:DyQiaaewIsgCQGIgYDehpvt

    Score
    10/10
    mysticgooglepaypalpersistencephishingstealer

    • Detect Mystic stealer payload

    • Detected google phishing page

      phishinggoogle

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Detected potential entity reuse from brand paypal.

      phishingpaypal

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks