Extracted

• • Target

    4fcea54a9c17fac90f3b6b0d80308d5f2b7ae10c2bf51e495aed311cf2dee18a.exe

  • Size

    1.3MB

  • MD5

    28da1699191ac8a7caf7f6dabe7cf475

  • SHA1

    681fadf79f8a1cd021e5d60d96928bce8efeb950

  • SHA256

    4fcea54a9c17fac90f3b6b0d80308d5f2b7ae10c2bf51e495aed311cf2dee18a

  • SHA512

    de4df88d6a87ae40206c0db9d0605f484ae85e115ff8c162ff5634273de85b5e81b96f95ade69c6043b8d37edadedfc9d9513982203bb3118d083c4a4f683d4b

  • SSDEEP

    24576:IyujT5rYFSSOo757Kj+i+WXC2n08QAm7W7Q4CVrz3LYdf:PSG0Sr1Ki9WXf0x7W7kfy

  Score

  10^/10

  mysticsmokeloaderbackdoorevasionpersistencestealertrojan

  • Detect Mystic stealer payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1