Extracted

• • Target

    d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe

  • Size

    639KB

  • MD5

    92346d27eabac81e606d7153397e64e2

  • SHA1

    fd2b60f3663a6ffe24db4d8bd4d244bfd7e0ecaa

  • SHA256

    d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200

  • SHA512

    446b3f391e6f55bd1fb69969e74c42ba298bd06ab9509130e639da3e03f2720fa753921a1aec5c8e7732928d125a97a9ae2e0a2dbe7b705c1e183ab8a41c3063

  • SSDEEP

    12288:EMrWy90u8xoCoUCnq8yr2b2VmLKGQDzLfTf/1TW:ay9817x2wG+zHBW

  Score

  10^/10

  mysticsmokeloaderbackdoorevasionpersistencestealertrojan

  • Detect Mystic stealer payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2