Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    uB6hG11.exe

  • Size

    656KB

  • Sample

    231113-lkztgabh4t

  • MD5

    91362448abc61956603e3add03dfda3b

  • SHA1

    a797f165840fc89225807664bf2092b09bd7bd0c

  • SHA256

    a0c59491384562a15a5117665047d8d5dcf1fda4e88791cbeb719176b9cc75b6

  • SHA512

    693e4a9401adc30d51d4fc41a762ae33b39d8ad82d798bde9c4d0ffbb5f49f8eac6636365b173e0b974d0f5ed7aa0422b0d057914c19a2f650c33a2212eaf90b

  • SSDEEP

    12288:LMrgy90L0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL650lOCwp:7ygiaaewIsgCQGIgYDb4Ot

Score
10/10
mysticgooglepaypalpersistencephishingstealer

Malware Config

Targets

    • Target

      uB6hG11.exe

    • Size

      656KB

    • MD5

      91362448abc61956603e3add03dfda3b

    • SHA1

      a797f165840fc89225807664bf2092b09bd7bd0c

    • SHA256

      a0c59491384562a15a5117665047d8d5dcf1fda4e88791cbeb719176b9cc75b6

    • SHA512

      693e4a9401adc30d51d4fc41a762ae33b39d8ad82d798bde9c4d0ffbb5f49f8eac6636365b173e0b974d0f5ed7aa0422b0d057914c19a2f650c33a2212eaf90b

    • SSDEEP

      12288:LMrgy90L0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL650lOCwp:7ygiaaewIsgCQGIgYDb4Ot

    Score
    10/10
    mysticgooglepaypalpersistencephishingstealer

    • Detect Mystic stealer payload

    • Detected google phishing page

      phishinggoogle

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Detected potential entity reuse from brand paypal.

      phishingpaypal

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks