Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Qw0CJ10.exe

  • Size

    656KB

  • Sample

    231113-lnj77acd23

  • MD5

    1e92b1e4bca5a28c446d6881d7549d0b

  • SHA1

    3f0d9a927ed1110849748425b15e548bbc8c3115

  • SHA256

    ca998219530a87cc508206d4120df56dec6b7d65f8e3950b71638023ac3ef9c0

  • SHA512

    7fb35bf6ad6b9f75d5bee6bddb2bd56c9ae8a3aef294aa60f530828847fba996d3174e8140926fc825f2ef74e350fbc0d5e649759f85b68cbaa80a6d9db5de2d

  • SSDEEP

    12288:mMr2y90b0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6cKLmCWev:sy0iaaewIsgCQGIgYDBLB

Score
10/10
mysticgooglepersistencephishingstealer

Malware Config

Targets

    • Target

      Qw0CJ10.exe

    • Size

      656KB

    • MD5

      1e92b1e4bca5a28c446d6881d7549d0b

    • SHA1

      3f0d9a927ed1110849748425b15e548bbc8c3115

    • SHA256

      ca998219530a87cc508206d4120df56dec6b7d65f8e3950b71638023ac3ef9c0

    • SHA512

      7fb35bf6ad6b9f75d5bee6bddb2bd56c9ae8a3aef294aa60f530828847fba996d3174e8140926fc825f2ef74e350fbc0d5e649759f85b68cbaa80a6d9db5de2d

    • SSDEEP

      12288:mMr2y90b0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6cKLmCWev:sy0iaaewIsgCQGIgYDBLB

    Score
    10/10
    mysticgooglepersistencephishingstealer

    • Detect Mystic stealer payload

    • Detected google phishing page

      phishinggoogle

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks