mystic | 1374c21f40fdab5a9e72b4768caf0134d81cf36e0448889013d6005f76280759 | Triage

Sharing

General

Target

1374c21f40fdab5a9e72b4768caf0134d81cf36e0448889013d6005f76280759
Size

678KB
Sample

240417-qkdcpaaf3w
MD5

61880961739e9eb32a29eaeb869b0eb5
SHA1

bb61919984985e6a88eaaf1eeef541c0eb2b1c30
SHA256

1374c21f40fdab5a9e72b4768caf0134d81cf36e0448889013d6005f76280759
SHA512

4162f1b219f731537ff8ae5d1b806db1b0ccb85369faf6cc3d3a57157147c66f4ddd88f30003d6333f3b09dd7f5eda128acebfcf6902c647572276cb4d526502
SSDEEP

12288:5MveGZ9eOuqhALqflmNlNyPlKfJhPF/4IK7iRxOfIGhXg3fr2WY1:5MWGgUTlEqlG3Fgz7+IQUw3TBY1

Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan

Malware Config

Targets

- Target
  
  088a62b3ab8a6cb9e8c78e220d8aec5b8ed463d91a3309299e17a2e90af11aea.exe
- Size
  
  721KB
- MD5
  
  1682ace070b7498115d27c779d4d41e5
- SHA1
  
  1a2c3384b780cda0688ff7ffc4a53d3de35fde12
- SHA256
  
  088a62b3ab8a6cb9e8c78e220d8aec5b8ed463d91a3309299e17a2e90af11aea
- SHA512
  
  0d593cd2dbe498fc270273c8f78f9b9f8e836245b564454d3cdc45747643a04d06055a7b4cf90d81dc76d5f533c6f2be14f355e9d8a2212b6e6edffb32ad7213
- SSDEEP
  
  12288:jMrwy90ZmDRb95JLu/m3kDmURMr20yALGFUM3jeueRDY0mUTR4dptCBXIc6b:ryb5SmUDmU02HAqh6FdqpkBp6b
Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

mysticsmokeloaderbackdoorevasionpersistencestealertrojan