mystic | 28c6afd9dbe7547caddddc77f393e8c2925c1bb7ee72f531b8daa7622351d6d9 | Triage

Sharing

General

Target

274602f22d15c9edfaa9170361b6fae8593699ed5d37efd259e2363a66bd666b.zip
Size

989KB
Sample

240402-l7fzwaeg35
MD5

b9766e67b1d90814dad9b2ee0c2b8d00
SHA1

d7d0877da9bb90354373e8393950577b625e92f1
SHA256

28c6afd9dbe7547caddddc77f393e8c2925c1bb7ee72f531b8daa7622351d6d9
SHA512

ef19832978e2927bcf60b913720ca8d0c5799a27d833c509ab1db35541ec0ebd13736c1b285d25b146e70658d7580d270298e50909015fdcd39173a6b00571bb
SSDEEP

24576:ruOaJP9xtgD6Vwz5WuFEkfY++mwElrir334nRg9Sgj5hICXv9KzWA3:ruOaJKBrmE7wYaO4JKWg

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

C2

77.91.124.55:19071

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

rc4.i32

Targets

- Target
  
  274602f22d15c9edfaa9170361b6fae8593699ed5d37efd259e2363a66bd666b.exe
- Size
  
  1.0MB
- MD5
  
  44fadc7ff5089a660f20e84491564413
- SHA1
  
  bc55f02398f9d4754267dd6ec32f8ce32b81a0f5
- SHA256
  
  274602f22d15c9edfaa9170361b6fae8593699ed5d37efd259e2363a66bd666b
- SHA512
  
  5cf14c885e6e685f4984057d19013ef4edb9550da1c6848654b81d0332d53365b512bfe9f63b0318f203d4cbf8d24ef315da6c88b285311dafa604bee84646ba
- SSDEEP
  
  12288:WMrmy90n/LFPEu33VEA1x/KkzNP73Yxbp4YM2ixo53HtT6Aro9UIUQZf0ZHp/7nC:EyyRVEAXKk13YohxQdeAro2INl0j7C
Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

mysticredlinesmokeloaderbrehabackdoorevasioninfostealerpersistencestealertrojan