mystic | c6816ffd82b36cad619d88b55686e1f43dc9c73679dc4bdea2cd3b8779603d05 | Triage

Sharing

General

Target

c6816ffd82b36cad619d88b55686e1f43dc9c73679dc4bdea2cd3b8779603d05
Size

816KB
Sample

240417-qrs2qahe76
MD5

47e8418f6845731d6d3edb70598ff0f1
SHA1

92bbd02aa5977b7d3b65d4dcf48081e1d8bbe6b1
SHA256

c6816ffd82b36cad619d88b55686e1f43dc9c73679dc4bdea2cd3b8779603d05
SHA512

81883ada496028756455d87562f5f5d701b67cfd4d672617f18e1cd26f9c2147ed9cb487b9e7b369cada3c606af28e770641985c62c019ffc680e6222e67391a
SSDEEP

12288:BoO952fwIQPaqKl/qBSEhtHG0UgEgglBCxPGVQ9JdrLxH9bpXqtjUAyByBS1l:BoO9QGe/MhUZgZgGJNv/Z9bFqtjUAKl

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

rc4.i32

Extracted

Family

redline

Botnet

breha

C2

77.91.124.55:19071

Targets

- Target
  
  cbf2171616a11736845095e1a1e40b71c7a6b51e3c4453da03db769132820714.exe
- Size
  
  860KB
- MD5
  
  10546d4f84b9966d5f72ed3bdf530c4c
- SHA1
  
  f0179725a1691177a47341327ebaa2e0d2864edb
- SHA256
  
  cbf2171616a11736845095e1a1e40b71c7a6b51e3c4453da03db769132820714
- SHA512
  
  bdc714a77f447a130c10511b4a066b13180fd723c79efc59e4ead98e11b4fec73bf083431d19deec7036c5ee7a460f2e8f29c2651325f334e66e7eb53f130a05
- SSDEEP
  
  24576:pyzao0HuuMlmyvo5SO93mlKkgpvkryQwJiQHehoZM:cHuMl503Dkgkyiu
Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

mysticredlinesmokeloaderbrehabackdoorevasioninfostealerpersistencestealertrojan