myth_stealer | c7e707e37ffd05bea41107d711bef3a3b6216cca69902fa790f3e96d68506a27

Resubmissions

04/11/2025, 16:07

251104-tkvthsdn9110

14/10/2025, 13:51

251014-q527jssn199

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2025, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EverlightSetupOfficiel.exe
Size 67.5MB
Sample251104-tkvthsdn91
SHA256 c7e707e37ffd05bea41107d711bef3a3b6216cca69902fa790f3e96d68506a27
MD5 a29fedaa6fb77d626ae6690081002e15
SHA1 1cfdf7143e282ca1a9ce35b6b9b5fb6596a154e7
SHA512 c5342459811804afd69e1add33f0eefabe933e6175ef91875e3d74d6b500a3631a381d19c69e7a3c1b88aa9f19ac03aaaaa32743c388aecdc748fa69b0c68278
SSDEEP 1572864:C5zXboXOfIroZD4PBtvCbJnkPZJwvdnh:C5XouIZPiJkBJwvdn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion myth_stealer stealer

Malware Config

Signatures

Detects MythStealer Java payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024254-163.dat	family_mythstealer_java

MythStealer
MythStealer is an infostealer written in Rust and operating since December 2024.
stealer myth_stealer
Myth_stealer family
myth_stealer

Enumerates VirtualBox DLL files 2 TTPs 10 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxmrxnp.dll	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxoglcrutil.dll	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxoglpackspu.dll	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxoglpassthroughspu.dll	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxoglarrayspu.dll	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxoglerrorspu.dll	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxoglfeedbackspu.dll	EverlightSetupOfficiel.exe

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	EverlightSetupOfficiel.exe

Looks for VirtualBox executables on disk 2 TTPs 3 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxservice.exe	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\vboxtray.exe	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\VBoxControl.exe	EverlightSetupOfficiel.exe

Looks for VMWare drivers on disk 2 TTPs 3 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\Vmmouse.sys	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	EverlightSetupOfficiel.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	EverlightSetupOfficiel.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1466988471-277302908-4206077581-1000\Control Panel\International\Geo\Nation	EverlightSetupOfficiel.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	javaw.exe

Loads dropped DLL 10 IoCs

pid	Process
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2096	2476	EverlightSetupOfficiel.exe	92
PID 2476 wrote to memory of 2096	2476	EverlightSetupOfficiel.exe	92

C:\Users\Admin\AppData\Local\Temp\EverlightSetupOfficiel.exe
"C:\Users\Admin\AppData\Local\Temp\EverlightSetupOfficiel.exe"
1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VirtualBox executables on disk
- Looks for VMWare drivers on disk
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\javaw.exe
  "C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\javaw.exe" -noverify -jar "C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Plugins\lCiwfy1tBfGD.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

java.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\java.dll
Size 115KB
SHA256 96e1f27a5cbdd8998dded620bf04eff0de20503ddc22ed8083ef7eb4f0973902
MD5 c9d7919f644ea468b134a74bec8da596
SHA1 0d161b15511952d29de396fc521218d3f290ef92
SHA512 9f51cae58bb5f63ac653922848d3b062eeaa67488c358ae61ea312f99aba76a8082df9448ff6e1e069a72895cdabab15277378324d0477e9e4569ee68e2a5ca1
SSDEEP 3072:8wbflUcjSh6ZJQIQ24yNGWxVrarwrVOFXJT51td6G60kA:ZbflUcAIb1Gv
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\javaw.exe
Size 53KB
SHA256 ed20288d2cad9a5f9a9577be2398102717724abba009b6e12842219ac07d13fc
MD5 1fb2d80d278e900673b165b8a4b1c629
SHA1 b9a457d1e0e0cc64e0862df7f8d1eecb1bed7e27
SHA512 bfd8d86407ae34bacfaf157aa27ed1980cadffcde5333218e668c74a28c4f73ae5ee36ef984a81e24c0cfc4c3c455f2ea386cd18284e5eb1ccdf8aabc81ff909
SSDEEP 768:FJ2GLAuDeGJiqrmehiVSrmaBP39VuL5BYiFUJ2Ex:F+7qjh3rmKPNIL5B7s3
MD5 SHA1 SHA512 SSDEEP

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\jimage.dll
Size 32KB
SHA256 87a84e2e48d65a6ad1ea68d0c9639dd3ccddbaa8ea709804855c3cef6f87072d
MD5 e44b21d0e58c07b1b3bac719c913239b
SHA1 5bc02b567d0c661e27841ac63c7f4157a32c5015
SHA512 f82492f1fda882ff7f6c843513a200d9d14690c085c46b363188d4343003d69d31c1fe6c432b09d16a91f042445a4d6198ca2bc5d552bc27f406e226be9eba5a
SSDEEP 768:0IErLScGNJ+N5J1Q4i8zMEjvZN+YiYW2Ei:0XLgG91m8zFjRN+7t0
MD5 SHA1 SHA512 SSDEEP

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\jli.dll
Size 83KB
SHA256 9a1f3207a3f1e42b78eaf39611d70b87d7f1204c89246a3bf96370d2f501d79b
MD5 83fe946d3a8372daf1dcce43533ef5b2
SHA1 7f31a53c59bc249904815b9f3915d2656843fdf5
SHA512 e86d22f64949466058f689e97de74d734fd30d1bf4644fe45c2585302151e5056358f75bee34b15033f7dcb1a64af793164e2887e057fd5cca025c501168c83b
SSDEEP 1536:HQt68lPbKXBdYrtK4zgU3GmeIO57StiV97oz:wtriohKev7M57S0V9E
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\msvcp140.dll
Size 564KB
SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
MD5 1ba6d1cf0508775096f9e121a24e5863
SHA1 df552810d779476610da3c8b956cc921ed6c91ae
SHA512 9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af
SSDEEP 12288:RBSNvy11qsslnxU/1ceqHiNHlOp/2M+UHHZpDLO+r2VhQEKZm+jWodEEVAdm:RBSDOFQEKZm+jWodEE2dm
MD5 SHA1 SHA512 SSDEEP

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\net.dll
Size 58KB
SHA256 b2b843d17273805803388e92ab96be034b3db6120b793a29c6365d8273f34105
MD5 c03cb2f0f2e5ab7adcf51621105f3d0e
SHA1 f0f6ed86b89a08fdaa9397fb91371ffc0caf3986
SHA512 1c4d7221d42ec42b26478fb7acdea990325f34dba7a4a9c2895208f210ffc8f979a842adc6d4e0790b64fae81a9e3e221d5b8edc203a3d411a94d99621ff2cd5
SSDEEP 1536:j/uy96L0wePykznMlJffZew9YsVbEwCIwe7z7:jW/kzMDRe6YsVAwCA7
MD5 SHA1 SHA512 SSDEEP

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\nio.dll
Size 78KB
SHA256 faf83553b4fafe92ec34504e2f031bc54b1d18ded875910bfe8ff75080250490
MD5 1495b396dc4e183f31b69d9614efb0cf
SHA1 6171546e6f3ebce9b70139c15ef84c36880b1d18
SHA512 2fa4802933512311c8d784138cfbdb7c6c341c8e29477b1facc95e253d32539dc28588aa0b0a50800ba2702f3ddfdde115faa103fc1e39d23da0102fa3eb9b72
SSDEEP 1536:k3+A0IpUKCHqF+X7W5K6RwICDdm2ln70Sg:yZ0LKaqF+LWU6RwICDjnlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\server\jvm.dll
Size 12.9MB
SHA256 819d252656fb9969e5f296f6de0801181f2b634e63c3cfcb4858da2f3149b6bf
MD5 db3b0086118c91e8f2df0b457ddde6eb
SHA1 ccbf78c9bbb0dd9960bd14d42b0c3e3b491a1a96
SHA512 85940e319d08ee56991a3c4d6b5b41cb35e1d43be3a113d19c1d873067488dcea72aaab6c6db80240fd75139e1db6ac3843924013d32b44ef6ca5ce6b00fe885
SSDEEP 393216:NwOv+WseS9RWABxcE1R5vOsL22xI5SXnFXpcJrtxiO9UqzBBRmTrlTXn1DtcPUJo:XBzD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\vcruntime140.dll
Size 106KB
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\vcruntime140_1.dll
Size 48KB
SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
MD5 cf0a1c4776ffe23ada5e570fc36e39fe
SHA1 2050fadecc11550ad9bde0b542bcf87e19d37f1a
SHA512 d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168
SSDEEP 768:a0Q4HUcGJZekJSam1BbuBSYcCZbiLzlSHji9z4GwZHji9znwT:afnDex5izbiLzlE+z4Gwl+zwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\bin\zip.dll
Size 82KB
SHA256 eca571cb16fbd2baf7136227ebcbc4bf83fb24543c87ed77c6437e3905f86a0e
MD5 c92971f9daafabb476022d4eb67d1e0e
SHA1 91aa9805fd8d76d8237c4c767984918b3779ef81
SHA512 8003f1e08ea7270e3fb157e67e0115f91729d9e1c5ff58dfb04db1c7a592549678c6d407605e38d7a76776dd7da0186c886fc4b5ca1f3ddf249393219b377f33
SSDEEP 1536:nHz+evDkdevijXIftHtLR0GMKc5IOQIO22szEgx74X3:nHz+evDSeIXgLTMjTG22uEua
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\legal\java.prefs\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\legal\java.prefs\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Libraries\lib\modules
Size 22.9MB
SHA256 03a33eacafcb705906fd23078eda264c5863ce8571f0b8f9710a67a4c6fcefde
MD5 97559e66324df5b1c982b60ceaae7d19
SHA1 94183a5d4ca68e25ef35a74914f04465f7d77a60
SHA512 bde0ddc8c6551b07e86e87d89dcf0fbab50cd7fb34cc6a77f325abe621c5350d00818f3a2c40c937b447b89bd9b48243effb9ce63c0762db1f4059162f779d73
SSDEEP 393216:KLsbbYEvUTZLtFJb7J8XT1M3JiaaZb9nnwECQK//HpLfrbbJ9r8:4OhvCtFJnkPZJnwvd//VzvJ9Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

lCiwfy1tBfGD.jar

Path C:\Users\Admin\AppData\Roaming\Installer-yaUAICCnld5KML82\Plugins\lCiwfy1tBfGD.jar
Size 20.6MB
SHA256 4dd20d10e17a591089009b18b496b38c12173031e0d6ab6edbc505076c974fa7
MD5 f5ec889f64f8ee29477f455da9667880
SHA1 736ed5b021582f0cfa810824897ef960a90d23f2
SHA512 56b558f6df0e92e8ca79177a192af4ea3cab92a27b6e8bc60d6557f36e0706a1c4258c649497ee3028b6e132277ef717220bfb342be7d7528e029f29c0f3530e
SSDEEP 393216:6mvPJY1MkcXWc/gegp5xxqzf3UE/qxj3UeKxQah0mz6vwgkz:BXJAEXboegT/qzfEE/qxjAQaa5jg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads