Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ZZ2Nr82.exe

  • Size

    658KB

  • Sample

    231113-lmax5acc95

  • MD5

    5809b037942fc4f2c4fb1dbcd231aad9

  • SHA1

    060e6f6e88d5b651ff986dbadd5e57f51b2d5b04

  • SHA256

    ea017ffa86cd50c7db864fc0b78f3020a3f74329329b8a4ce16b40c5695f1945

  • SHA512

    18c50fdac8e6aa4acae61370a1535f71aea92266ab25f82ada2595e24b5dab67e00821e769dad25f29ce0965f15eb23a6fb4552e70dad8cd64cc9b48f886b65f

  • SSDEEP

    12288:3MrSy90P0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6wTsrvfayGahdk:JyAiaaewIsgCQGIgYDmTQGahW

Score
10/10
mysticgooglepaypalpersistencephishingstealer

Malware Config

Targets

    • Target

      ZZ2Nr82.exe

    • Size

      658KB

    • MD5

      5809b037942fc4f2c4fb1dbcd231aad9

    • SHA1

      060e6f6e88d5b651ff986dbadd5e57f51b2d5b04

    • SHA256

      ea017ffa86cd50c7db864fc0b78f3020a3f74329329b8a4ce16b40c5695f1945

    • SHA512

      18c50fdac8e6aa4acae61370a1535f71aea92266ab25f82ada2595e24b5dab67e00821e769dad25f29ce0965f15eb23a6fb4552e70dad8cd64cc9b48f886b65f

    • SSDEEP

      12288:3MrSy90P0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6wTsrvfayGahdk:JyAiaaewIsgCQGIgYDmTQGahW

    Score
    10/10
    mysticpersistencestealergooglepaypalphishing

    • Detect Mystic stealer payload

    • Detected google phishing page

      phishinggoogle

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Detected potential entity reuse from brand paypal.

      phishingpaypal

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks