Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    qh7oG18.exe

  • Size

    656KB

  • Sample

    231113-lh9kwsbh3y

  • MD5

    730a927e4fafaf2a63c1c9f2f0a00cd4

  • SHA1

    37858a42866b6eefee5a4b639fe5dd6f412a4e81

  • SHA256

    48eaf2763a68bad2f478400d735294b580f597b28bf27437470ad2c420e67a31

  • SHA512

    4292c698a1a502c08c5c0734117d46609ff71a3d86272f64e4b7a3be11132793a55848c54814df5d89fa87847360244f9a28587fe74029eb9484c5bfa9bc2b2d

  • SSDEEP

    12288:MMr+y90L0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6oblAHOZdz:ayAiaaewIsgCQGIgYDUGHs

Score
10/10
mysticgooglepaypalpersistencephishingstealer

Malware Config

Targets

    • Target

      qh7oG18.exe

    • Size

      656KB

    • MD5

      730a927e4fafaf2a63c1c9f2f0a00cd4

    • SHA1

      37858a42866b6eefee5a4b639fe5dd6f412a4e81

    • SHA256

      48eaf2763a68bad2f478400d735294b580f597b28bf27437470ad2c420e67a31

    • SHA512

      4292c698a1a502c08c5c0734117d46609ff71a3d86272f64e4b7a3be11132793a55848c54814df5d89fa87847360244f9a28587fe74029eb9484c5bfa9bc2b2d

    • SSDEEP

      12288:MMr+y90L0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6oblAHOZdz:ayAiaaewIsgCQGIgYDUGHs

    Score
    10/10
    mysticgooglepaypalpersistencephishingstealer

    • Detect Mystic stealer payload

    • Detected google phishing page

      phishinggoogle

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Detected potential entity reuse from brand paypal.

      phishingpaypal

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks