mysteriumnodeproxyware | d1614953c4c23b7346fd9a58e6072b7a5b059d74f5ab3895a9589a25436cb982

Analysis

custom tags

dropperpersistencepowershellproxyware
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1614953c4c23b7346fd9a58e6072b7a5b059d74f5ab3895a9589a25436cb982.exe
Size 35KB
Sample260820-krksfstanh
SHA256 d1614953c4c23b7346fd9a58e6072b7a5b059d74f5ab3895a9589a25436cb982
MD5 13e6a2dc0515b0257faf907289936b70
SHA1 0231ea1e5ecd22725c45b4d700d2ad202357e7ab
SHA512 8cf5b69c4c61797d0d512a4792d33d769cbf6331e9b828f65e58f74f757f0121b40039b75b8a6bd2d276c83b7e7c69abf2eb74d1199b4a4f028aa15a5318d0dd
SSDEEP 768:TJd7r0Kqdm1zDBcBl4uPphSMjEh8Y4dptGoWet9XdV:PP02BcXPSMjEwtGo9t9Xb
TLSH
T113F24B159E910123EAD3C339F8E3A342B57FC06911095498F6EEC2A96FD13ACC35A6D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery dropper execution mysteriumnodeproxyware persistence powershell proxyware

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://127.0.0.1:4050
exe.dropper
https://jpll.dev/registro.php

Extracted

Language

Source

URLs

exe.dropper
http://127.0.0.1:4050

Signatures

Family: mysteriumnodeproxyware
mysteriumnodeproxyware

MysteriumNode proxyware installer PowerShell payload 1 IoCs

Detects the extracted script that silently installs, persists, claims, and monetizes a Mysterium node.

dropper proxyware powershell persistence

resource	yara_rule
behavioral2/files/0x0006000000016b3a-7.dat	MysteriumNode_Proxyware_Installer_PS1

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3728	powershell.exe
6	3728	powershell.exe
8	3728	powershell.exe
58	3728	powershell.exe
182	1204	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3728	powershell.exe
1204	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
120	myst.exe
1364	myst.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1076	icacls.exe

Looks up external IP address via web service 1 TTPs 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
17	ident.me
50	api.ipify.org
51	ifconfig.me
54	api.ipify.org
159	api.ipify.org
1	ifconfig.me

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3472	wscript.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_mannwlj0.4gl.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zzqmpq2e.jvs.ps1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2340	cmd.exe
5088	cmd.exe
6112	cmd.exe
3572	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
120	myst.exe
1364	myst.exe
3572	cmd.exe
4632	PING.EXE

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4632	PING.EXE

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3728	powershell.exe
3728	powershell.exe
3728	powershell.exe
3728	powershell.exe
6016	wmic.exe
6016	wmic.exe
6016	wmic.exe
6016	wmic.exe
768	wmic.exe
768	wmic.exe
768	wmic.exe
768	wmic.exe
3268	wmic.exe
3268	wmic.exe
3268	wmic.exe
3268	wmic.exe
4424	wmic.exe
4424	wmic.exe
4424	wmic.exe
4424	wmic.exe
5328	wmic.exe
5328	wmic.exe
5328	wmic.exe
5328	wmic.exe
3008	wmic.exe
3008	wmic.exe
3008	wmic.exe
3008	wmic.exe
2192	wmic.exe
2192	wmic.exe
2192	wmic.exe
2192	wmic.exe
1204	powershell.exe
1204	powershell.exe
1204	powershell.exe
2112	wmic.exe
2112	wmic.exe
2112	wmic.exe
2112	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeIncreaseQuotaPrivilege	3728	powershell.exe
Token: SeSecurityPrivilege	3728	powershell.exe
Token: SeTakeOwnershipPrivilege	3728	powershell.exe
Token: SeLoadDriverPrivilege	3728	powershell.exe
Token: SeSystemProfilePrivilege	3728	powershell.exe
Token: SeSystemtimePrivilege	3728	powershell.exe
Token: SeProfSingleProcessPrivilege	3728	powershell.exe
Token: SeIncBasePriorityPrivilege	3728	powershell.exe
Token: SeCreatePagefilePrivilege	3728	powershell.exe
Token: SeBackupPrivilege	3728	powershell.exe
Token: SeRestorePrivilege	3728	powershell.exe
Token: SeShutdownPrivilege	3728	powershell.exe
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeSystemEnvironmentPrivilege	3728	powershell.exe
Token: SeRemoteShutdownPrivilege	3728	powershell.exe
Token: SeUndockPrivilege	3728	powershell.exe
Token: SeManageVolumePrivilege	3728	powershell.exe
Token: 33	3728	powershell.exe
Token: 34	3728	powershell.exe
Token: 35	3728	powershell.exe
Token: 36	3728	powershell.exe
Token: SeIncreaseQuotaPrivilege	3728	powershell.exe
Token: SeSecurityPrivilege	3728	powershell.exe
Token: SeTakeOwnershipPrivilege	3728	powershell.exe
Token: SeLoadDriverPrivilege	3728	powershell.exe
Token: SeSystemProfilePrivilege	3728	powershell.exe
Token: SeSystemtimePrivilege	3728	powershell.exe
Token: SeProfSingleProcessPrivilege	3728	powershell.exe
Token: SeIncBasePriorityPrivilege	3728	powershell.exe
Token: SeCreatePagefilePrivilege	3728	powershell.exe
Token: SeBackupPrivilege	3728	powershell.exe
Token: SeRestorePrivilege	3728	powershell.exe
Token: SeShutdownPrivilege	3728	powershell.exe
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeSystemEnvironmentPrivilege	3728	powershell.exe
Token: SeRemoteShutdownPrivilege	3728	powershell.exe
Token: SeUndockPrivilege	3728	powershell.exe
Token: SeManageVolumePrivilege	3728	powershell.exe
Token: 33	3728	powershell.exe
Token: 34	3728	powershell.exe
Token: 35	3728	powershell.exe
Token: 36	3728	powershell.exe
Token: SeIncreaseQuotaPrivilege	3728	powershell.exe
Token: SeSecurityPrivilege	3728	powershell.exe
Token: SeTakeOwnershipPrivilege	3728	powershell.exe
Token: SeLoadDriverPrivilege	3728	powershell.exe
Token: SeSystemProfilePrivilege	3728	powershell.exe
Token: SeSystemtimePrivilege	3728	powershell.exe
Token: SeProfSingleProcessPrivilege	3728	powershell.exe
Token: SeIncBasePriorityPrivilege	3728	powershell.exe
Token: SeCreatePagefilePrivilege	3728	powershell.exe
Token: SeBackupPrivilege	3728	powershell.exe
Token: SeRestorePrivilege	3728	powershell.exe
Token: SeShutdownPrivilege	3728	powershell.exe
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeSystemEnvironmentPrivilege	3728	powershell.exe
Token: SeRemoteShutdownPrivilege	3728	powershell.exe
Token: SeUndockPrivilege	3728	powershell.exe
Token: SeManageVolumePrivilege	3728	powershell.exe
Token: 33	3728	powershell.exe
Token: 34	3728	powershell.exe
Token: 35	3728	powershell.exe
Token: 36	3728	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 3728	2484	d1614953c4c23b7346fd9a58e6072b7a5b059d74f5ab3895a9589a25436cb982.exe	89
PID 3728 wrote to memory of 2340	3728	powershell.exe	94
PID 2340 wrote to memory of 1076	2340	cmd.exe	95
PID 3472 wrote to memory of 5088	3472	wscript.exe	98
PID 5088 wrote to memory of 120	5088	cmd.exe	100
PID 120 wrote to memory of 6016	120	myst.exe	101
PID 3472 wrote to memory of 6112	3472	wscript.exe	102
PID 6112 wrote to memory of 1364	6112	cmd.exe	104
PID 1364 wrote to memory of 768	1364	myst.exe	105
PID 1364 wrote to memory of 3268	1364	myst.exe	106
PID 1364 wrote to memory of 4424	1364	myst.exe	107
PID 1364 wrote to memory of 5328	1364	myst.exe	108
PID 1364 wrote to memory of 3008	1364	myst.exe	109
PID 1364 wrote to memory of 2192	1364	myst.exe	110
PID 1364 wrote to memory of 2112	1364	myst.exe	113
PID 2484 wrote to memory of 3572	2484	d1614953c4c23b7346fd9a58e6072b7a5b059d74f5ab3895a9589a25436cb982.exe	114
PID 3572 wrote to memory of 4632	3572	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\d1614953c4c23b7346fd9a58e6072b7a5b059d74f5ab3895a9589a25436cb982.exe
"C:\Users\Admin\AppData\Local\Temp\d1614953c4c23b7346fd9a58e6072b7a5b059d74f5ab3895a9589a25436cb982.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "icacls "C:\ProgramData\MysteriumNode" /grant "FRPTRMXS\Admin":(OI)(CI)M /T >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\MysteriumNode" /grant "FRPTRMXS\Admin":(OI)(CI)M /T
      4⤵
      Modifies file permissions
      PID:1076
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\d1614953c4c23b7346fd9a58e6072b7a5b059d74f5ab3895a9589a25436cb982.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5212

C:\Windows\system32\wscript.exe
"wscript.exe" "C:\ProgramData\MysteriumNode\run-node.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\MysteriumNode\run-node.cmd" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\ProgramData\MysteriumNode\bin\myst.exe
    "C:\ProgramData\MysteriumNode\bin\myst.exe" --userspace --config-dir="C:\ProgramData\MysteriumNode\config" --data-dir="C:\ProgramData\MysteriumNode\data" --runtime-dir="C:\ProgramData\MysteriumNode\runtime" --log-dir="C:\ProgramData\MysteriumNode\data\logs" --node-ui-dir="C:\ProgramData\MysteriumNode\data\nodeui" --tequilapi.address=127.0.0.1 --tequilapi.port=4050 --ui.enable --ui.port=4449 --mmn.api-key=msphiIq5I20Aw7zJzQZjDqcDlJ4oUTUFcvQZeeQk --transactor.provider.try-free-registration=true service --agreed-terms-and-conditions --active-services=dvpn,data_transfer,scraping,monitoring,wireguard
    3⤵
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:120
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\MysteriumNode\run-node.cmd" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\ProgramData\MysteriumNode\bin\myst.exe
    "C:\ProgramData\MysteriumNode\bin\myst.exe" --userspace --config-dir="C:\ProgramData\MysteriumNode\config" --data-dir="C:\ProgramData\MysteriumNode\data" --runtime-dir="C:\ProgramData\MysteriumNode\runtime" --log-dir="C:\ProgramData\MysteriumNode\data\logs" --node-ui-dir="C:\ProgramData\MysteriumNode\data\nodeui" --tequilapi.address=127.0.0.1 --tequilapi.port=4050 --ui.enable --ui.port=4449 --mmn.api-key=msphiIq5I20Aw7zJzQZjDqcDlJ4oUTUFcvQZeeQk --transactor.provider.try-free-registration=true service --agreed-terms-and-conditions --active-services=dvpn,data_transfer,scraping,monitoring,wireguard
    3⤵
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:768
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3268
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4424
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5328
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3008
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2192
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\MysteriumNode\ensure-registered.ps1"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

version.txt

Path C:\ProgramData\MysteriumNode\bin\version.txt
Size 8B
SHA256 446e8f43fb79b1f1ae126ee7e1abca34c526b56e0489d8daa58d36344d0ed7e0
MD5 727dad1563ebd0d6e934bbd80ee330b4
SHA1 abfb2b444e76661a509198b9cd443b0e5d23f89a
SHA512 c63ca056e963b6d0dda609daf2f8fe0976f9aa4e4d88a8b6ab03240d1ab00aff210cefa05460df3dc125f248d00acc07e23769f8ce4cac222f8d3eb092f48186
MD5 SHA1 SHA512

Submit Download

check-status.ps1

Path C:\ProgramData\MysteriumNode\check-status.ps1
Size 1KB
SHA256 cd139e70ef156c325be9a245701625927e2d0eb8f91b18368af6092201db2d81
MD5 f2d8f67f56677dbaef789c8797dadf8f
SHA1 6580d2515987b4cfbb35fc4538dbe17aaa797c60
SHA512 2688e2c9e6fa685cf83000cf9a0ca1d7cfab33dd1d4e6ec9cd145740fc9c393c1423ed4b134bb12f00c866f28760d29f66d0c7a3c0f4ea09b378c4a2f55e2017
TLSH
T14111AF734D8A53074EC6519AE9714176B812D879CB0928E4BEEC04F260C7BFCF1925B7
MD5 SHA1 SHA512 TLSH

Submit Download

config-mainnet.toml

Path C:\ProgramData\MysteriumNode\config\config-mainnet.toml
Size 175B
SHA256 17abf17f3b750cbfd635a4b1256864bbed76bb5c9842e9e137a0598c5b09a11c
MD5 aaac81a4a22f8ecc846a769ef25cb3d5
SHA1 1e98208177486b1c536625c0119f9d1e3f1c6b07
SHA512 2b83370bf1cc43a9f4af285adb6649853df659858cb603724dc50dd80a057f40902047e105d4eb157d8982223fd7b6e77290e5c13b4ce4900dc1cb65d47d4fbd
TLSH
T1F8C08C25CE595072BE958E06FE9040D8A3BF693D388FA1B1364BC82E3142A1ECFC54C3
MD5 SHA1 SHA512 TLSH

Submit Download

UTC--2026-08-20T08-50-45.717926100Z--5f6f44e4355b5ccbb1ae297dea89aa37487eb5cc

Path C:\ProgramData\MysteriumNode\data\keystore\UTC--2026-08-20T08-50-45.717926100Z--5f6f44e4355b5ccbb1ae297dea89aa37487eb5cc
Size 489B
SHA256 c4ebc0f0f0c0915e8bc824a4d6a583d3b5a95145bdcbc70207de818dc62628f9
MD5 23faf5521503a4461bfe9b93893a99f2
SHA1 b17b5af91b47b4bb3f51cc0f8f6860810404dd1c
SHA512 8819d54ca32239b8e3fe7b6b7709453c55f51a8173758227305205e637a633d6b41b0c8b66989aa9617683319e78757330b123711a826678a3060cf03f90d808
TLSH
T112F00EA46814F8FA43B2C5D34678786981E49280DD0C5746C9C86F1AC2F9C6C90000D6
MD5 SHA1 SHA512 TLSH

Submit Download

remember.json

Path C:\ProgramData\MysteriumNode\data\keystore\remember.json
Size 69B
SHA256 b7d0d98cf18b865ed419da4c7e6bb972cabbf9771a7aa376c1517c8ca69c3ae5
MD5 8fce0ae7b6a2ade4fdc03df544d752c4
SHA1 52e6034d7b89ff3ce30d54123d648619ecc2ed74
SHA512 4cdec27683900fcea4d42adff9e977a800febcda5768bf9d8c4c31b1250c8d217cef5ef5c3c2d4f4888ec4d4233eda1651d52025e4b30752b9202183b9b01b48
TLSH
T11CA004551151357D514F57515355303740F555D44C4C4D455C5F577F057507FC45F4C4
MD5 SHA1 SHA512 TLSH

Submit Download

install.log

Path C:\ProgramData\MysteriumNode\data\logs\install.log
Size 816B
SHA256 4ec79436e1b2ffd0fa6c0dd56636ba0428e7d4c765a2afc1b4dd9e38ac2d9950
MD5 0e7da43c79a65da7fe2650fd652547f8
SHA1 83200a61e0d781496d92735d1ae0a82595d426e0
SHA512 35768900b4f015ce3a341d409df33076d220f981bbfd808591d5843c39662c990d1c1c90017575ba2ea35bfee34531f75c1f6c91868676fbe700e070b93b7b53
TLSH
T1DF01C9048AFE02936ED2271EE7227C89BB33F5213118B41E73EECA5410D6080CADD196
MD5 SHA1 SHA512 TLSH

Submit Download

mysterium-node.log

Path C:\ProgramData\MysteriumNode\data\logs\mysterium-node.log
Size 24KB
SHA256 427f95f0375ba66a7a02abc6c03509ddd01bf13f453b0e825a7c3d3fd8bec4ab
MD5 e457808f49ceef24315863eac0eb2794
SHA1 5a2b89526c3d8b33bd8eab77e6b3017ee6af3d22
SHA512 ed5aaaa692550f9413568d6f7bf6c3f5dd46284141e92ad77f3f316e820896c534a69132196888d90cf28fe2625297d6eba594c13ea9ad83b9ffd7068068ab20
SSDEEP 384:gXZuLoM9v/tWmxFv0A81HeJJJNvCbFZ/c3:g8LCB1HeXJ5CbF9M
TLSH
T14BB2EF8386F906FA2E5B63458F036E806E3AF303B70D498CBADF5655933141BE7D9849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mysterium-node.log

Path C:\ProgramData\MysteriumNode\data\logs\mysterium-node.log
Size 5KB
SHA256 f9442b8350aed2242ed85601f3f8431488d98469d8718ef4cb3ba6812935d850
MD5 d43d3242e220fce5597a2831c00a5890
SHA1 22fbfabd2679aadbcbdfa063a9679a207bef7e4c
SHA512 b1fb7c554b8db823bb4663bd1aebcac6bf7fc04bf2d36ae0f592a8b38a11cab0947ebaed4b6a8edd7b3bc4d7cf52caff91327bdc7dde4657e78811d362404a69
SSDEEP 96:K/gT6ZuhRLeePjN0jNIjNtjNWTN4Z2lsjNAjEYjEyyRUMi:gXZuLli2XLEK9F5UMi
TLSH
T1EEB1A38756F91BA12E5AA3088F025D802E27F303F31E868CFAEF9654DB35116E7D4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

myst.db

Path C:\ProgramData\MysteriumNode\data\mainnet\db\myst.db
Size 64KB
SHA256 832f1553d0856a3e2afd1fcfd0d0fefe912e6c7122883d03efd391f5c5948009
MD5 370b252ac84e9a8091e5225f8b2a6927
SHA1 8a99e9a212fc586ba61e5fcdf101f043b66a0420
SHA512 55c72f1b8c67d95ac1d995a0775a4345986e0bb3e8390be19527f63899fc0f6b58d148e5857441d5edeedda13c11788992685f642aba90156924c0cbe371c153
SSDEEP 24:qKtv5/ahXNrEnrbpguElhs+IZYBjMl2X4hnUV5qJiTRL95USdkwmwT/QdBIfgM3I:rkqnX2fkGm2oW5zGFUQgIHDxooWoE
TLSH
T11E53E38E8B40287BCA8F07BA09553313117DE9E157CB0301DA5EAABD49705B19B7F9CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ensure-registered.ps1

Path C:\ProgramData\MysteriumNode\ensure-registered.ps1
Size 2KB
SHA256 c9f5f2a2485f9adb41fb0578d78a940197f569f40c113dceae4fa542ef349b41
MD5 5789bfe3b0fcd414431bdf596a8892ed
SHA1 959468bdbad5f932844afd6aacc15b8fb0ecb0d9
SHA512 f78fe76a6d12c1fba79f034e864c7b1ccede991c8ef45f77c7f144d7c176798ec901aab68c38da53cf3e031ca5859716eef1b641d1d47e50e2b5b8c1c2a56328
TLSH
T16F5194779D2640039AC7825EFE7160963127E47B5A0D38AAFBED66D305A02FC5123AC9
MD5 SHA1 SHA512 TLSH

Submit Download

run-node.cmd

Path C:\ProgramData\MysteriumNode\run-node.cmd
Size 605B
SHA256 5bc1cfb7cd157015e2664b0f71bc15e59948992463cccd9c963d851df1ef132e
MD5 36210b8f9dee7f52afedcce7e283846e
SHA1 14305e6f700c39bb1bf77d475b0a5a4e8c4c76ea
SHA512 94b004d197b9254d0dc5793699713479adeed34e9728a7cf8071764b6ed1a1501514d0a90e91b93d5f081f2eb8ae4932a2c240f4d79acc88d588e1a009591e50
TLSH
T191F07023694527DB7903D12ABFA49D20417CD8492ACC242DA08D677A418AF391345802
MD5 SHA1 SHA512 TLSH

Submit Download

run-node.vbs

Path C:\ProgramData\MysteriumNode\run-node.vbs
Size 135B
SHA256 0d8c85102f36c7fc5c49b9623bf656b9ccfb93245aed9c49120611d7f0d2c5f7
MD5 bdb2dcb56d9552aa0dd25bc747817ffa
SHA1 0879739b265252d70f14c0c5bb911b5d4fc7c78b
SHA512 7cec81c69bb7682de8a4f8053d51dd193066c846ffd448dd3421a1cb7b54352a77c49a22dda43d2100c398e99899fdaed5dd9f06b5ebd3b5465cf7c215abe04c
TLSH
T106C02B5BE40CDBE6381364820732885C9B50DCC10141CD3F4444C93A70243B8070D003
MD5 SHA1 SHA512 TLSH

Submit Download

update-node.ps1

Path C:\ProgramData\MysteriumNode\update-node.ps1
Size 1KB
SHA256 b40eedcd4e3d82728b01116a61024f194e30498c62a9f5bd044932f6eb78970d
MD5 36667c90d70142780128c80f6af8aca7
SHA1 82241735234421349089e24009b42ea8f281cb25
SHA512 15a45383f9a535af4c2e73ffe2c6b369dd63fe27debc5483ff5ad3a499ffcc523c81062390cca990eda346f28b5995ca0e8cf007dc8a2f39b75af107db0ef5df
TLSH
T1C141B451612610B4C1C68322F8DAB7AC563FC01C800DF551B1ECD549AAD36FEC3527AB
MD5 SHA1 SHA512 TLSH

Submit Download

installer.ps1

Path C:\Users\Admin\AppData\Local\Temp\installer.ps1
Size 30KB
SHA256 b5d4e1b09151fe252811fcf7939e19ea13a754d6e6bfc59daa272ff38ab34ce4
MD5 98e7316d0200b01c11e72b4322b2280a
SHA1 94863974bb51d9eaae98432a381bb65e49a229f1
SHA512 f15d23dd1574eaba27eaf1497d48901eef8a017ea607294e9e7c842922ea425aa950ad9d306d986daf8331d00475874dcaa38a45bcd0f51c76e97eefb2b13bf4
SSDEEP 768:vd7r0Kqdm1zDBcBl4uPphSMjEh8Y4dptGoWex:FP02BcXPSMjEwtGo9x
TLSH
T139E25C259D5101336EC3C21EF8D3A292F57FC06811085898F6EEC2A96BD53ACC36A5D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

myst_supervisor.exe

Path C:\Users\Admin\AppData\Local\Temp\myst_ex_1.39.5\myst_supervisor.exe
Size 7.7MB
SHA256 47f350e850aee148ba06e480ce8c3f79b949672b6a537fe6a77b14f74b6c8dae
MD5 93fb166d382996afc056cc5bae7b97d0
SHA1 91a6b627cc4ccc6232898071145b5a14498506f8
SHA512 e5418d48d72b228c0ce3feed609b01fb697787c7bc93faacd176960067c2fcecc8be8f78d265462c857c1330b8ddfe73ac10ef00e5aa0d30787d360b84efbc7d
SSDEEP 49152:xZUG7ah04OXhZgA0YmeAIQBkIGGkdQCPWtxEhEvGneTJGg+ZmwmX2A8VhavX6t9D:xZ5iBp65Pe1Z+Hmc/T6hDtE
TLSH
T139864A07ECA554E9C0AED1318A729512BB71BC490B3127E76B90F7247F36BD0AEB9314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zzqmpq2e.jvs.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_zzqmpq2e.jvs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/120-123-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/120-105-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/1364-206-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/1364-256-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/1364-222-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/1364-234-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/1364-168-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/1364-245-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/1364-183-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/1364-195-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/1364-142-0x0000000000630000-0x00000000058DF000-memory.dmp

Download

memory/2484-39-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/2484-223-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/2484-0-0x0000000000F20000-0x0000000000F2E000-memory.dmp

Download

memory/2484-3-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/2484-1-0x00007FFE4D74F000-0x00007FFE4D750000-memory.dmp

Download

memory/3728-22-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-28-0x000002AC73B50000-0x000002AC73B74000-memory.dmp

Download

memory/3728-62-0x000002AC73F70000-0x000002AC73F7E000-memory.dmp

Download

memory/3728-63-0x000002AC73FD0000-0x000002AC73FEA000-memory.dmp

Download

memory/3728-64-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-65-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-66-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-72-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-43-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-42-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-41-0x000002AC73F80000-0x000002AC73F8A000-memory.dmp

Download

memory/3728-40-0x000002AC73F90000-0x000002AC73FA2000-memory.dmp

Download

memory/3728-36-0x000002AC74820000-0x000002AC74D48000-memory.dmp

Download

memory/3728-35-0x000002AC74120000-0x000002AC742E2000-memory.dmp

Download

memory/3728-32-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-88-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-27-0x000002AC73B50000-0x000002AC73B7A000-memory.dmp

Download

memory/3728-44-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-26-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-25-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-24-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-23-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-21-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-20-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-19-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-17-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-18-0x000002AC735E0000-0x000002AC735FE000-memory.dmp

Download

memory/3728-16-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-15-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-14-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-221-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-13-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3728-12-0x000002AC735B0000-0x000002AC735BA000-memory.dmp

Download

memory/3728-10-0x000002AC73590000-0x000002AC735AE000-memory.dmp

Download

memory/3728-11-0x000002AC73810000-0x000002AC738C2000-memory.dmp

Download

memory/3728-6-0x000002AC734D0000-0x000002AC734F2000-memory.dmp

Download