Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vM4sb31.exe

  • Size

    674KB

  • Sample

    231113-lqeeqacd54

  • MD5

    81990b879b34cbc467f11533553ad76e

  • SHA1

    de43ff6a1778687e6202e62606126204ebba42d4

  • SHA256

    578440b5b37937d30331d903c8be813438619dc249b998468fc8a750e170b744

  • SHA512

    53d0d843a9ef84ca2cb6b93368ea4b2d1610cea176438185ea04123d10621660a752d348f028cd89779a41dfe18d806c1fe1f9e8182f30f3df91fdd2cb9cbb12

  • SSDEEP

    12288:vMray90d0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6hSBep1YVk1yqPG7qs:ZysiaaewIsgCQGIgYD+gp1b1jG7qs

Score
10/10
mysticgooglepaypalpersistencephishingstealer

Malware Config

Targets

    • Target

      vM4sb31.exe

    • Size

      674KB

    • MD5

      81990b879b34cbc467f11533553ad76e

    • SHA1

      de43ff6a1778687e6202e62606126204ebba42d4

    • SHA256

      578440b5b37937d30331d903c8be813438619dc249b998468fc8a750e170b744

    • SHA512

      53d0d843a9ef84ca2cb6b93368ea4b2d1610cea176438185ea04123d10621660a752d348f028cd89779a41dfe18d806c1fe1f9e8182f30f3df91fdd2cb9cbb12

    • SSDEEP

      12288:vMray90d0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6hSBep1YVk1yqPG7qs:ZysiaaewIsgCQGIgYD+gp1b1jG7qs

    Score
    10/10
    mysticgooglepersistencephishingstealerpaypal

    • Detect Mystic stealer payload

    • Detected google phishing page

      phishinggoogle

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Detected potential entity reuse from brand paypal.

      phishingpaypal

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks