Overview

overview

10

Static

static

3

40c83fd2fe...46.exe

windows10-2004-x64

10

Resubmissions

05-04-2024 07:57

240405-js9mjaeh5y 10

10-11-2023 04:48

231110-fe873ada44 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40c83fd2fe671b3d0c79e15c6aea427042d50fe7ca29435a38feb0685e8d1b46

  • Size

    330KB

  • Sample

    240405-js9mjaeh5y

  • MD5

    73337493b31c5c10d102c7d42153c864

  • SHA1

    903d8ba2dab13ea55e0b6f13f607caff4df56aaa

  • SHA256

    40c83fd2fe671b3d0c79e15c6aea427042d50fe7ca29435a38feb0685e8d1b46

  • SHA512

    7848c05fe05430d48556acc5c75ee5b2b33df29356e5f20e204fd69ae3b2fde3abb515220cb515b962ae533dea5de2f093af84d8c66f5daff6e865be58eba23e

  • SSDEEP

    6144:KLy+bnr+fp0yN90QEE0ST8+kRAUXHx39ONZAQnJv8KW/4CMz5D+:9Mrny90pSTxymuQB8PAL+

Score
10/10
mysticpersistencestealer

Malware Config

Targets

    • Target

      40c83fd2fe671b3d0c79e15c6aea427042d50fe7ca29435a38feb0685e8d1b46

    • Size

      330KB

    • MD5

      73337493b31c5c10d102c7d42153c864

    • SHA1

      903d8ba2dab13ea55e0b6f13f607caff4df56aaa

    • SHA256

      40c83fd2fe671b3d0c79e15c6aea427042d50fe7ca29435a38feb0685e8d1b46

    • SHA512

      7848c05fe05430d48556acc5c75ee5b2b33df29356e5f20e204fd69ae3b2fde3abb515220cb515b962ae533dea5de2f093af84d8c66f5daff6e865be58eba23e

    • SSDEEP

      6144:KLy+bnr+fp0yN90QEE0ST8+kRAUXHx39ONZAQnJv8KW/4CMz5D+:9Mrny90pSTxymuQB8PAL+

    Score
    10/10
    mysticpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks