MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cb6e0bd581ffbd4fde23be74c956b0359be993ebc436e48a0dab931643aa731. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2cb6e0bd581ffbd4fde23be74c956b0359be993ebc436e48a0dab931643aa731
SHA3-384 hash: 9a6c3f0546548ba02783d8857190a26fc4da3220fd423479e520230ad0f3662a8697ed3571b7dba18acddd4599a1d72b
SHA1 hash: 2d7f41a63c580b9b1ffd4ab3674cb94ea93e4ade
MD5 hash: 1e5dc7f4341f9eba06a6b34545b93413
humanhash: pip-king-network-edward
File name:1e5dc7f4341f9eba06a6b34545b93413.exe
Download: download sample
Signature MysticStealer
Create hunting rule
File size:560'640 bytes
First seen:2023-11-10 07:42:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 12288:mMrIy904qMgJ2elD4CJqVo8yAQ3S4YEA0G/v5hD27yNvza:Cy6CCJqVotLY1h6Ira
TLSH T1C4C41223A7D89023D9F507B458F302930B37BD62AE74935B2B45A9491CB33D0A97637B
TrID 70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe MysticStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
266
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Creating a file
Launching a process
Сreating synchronization primitives
Running batch commands
Creating a window
Blocking the Windows Defender launch
Disabling the operating system update service
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
advpack anti-vm CAB control explorer greyware installer lolbin packed rundll32 setupapi sfx shell32
Link:
https://www.filescan.io/uploads/654ddf10946b6ab2245d8224/reports/f911cbdd-aa26-4861-a939-f060388a394e/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/2cb6e0bd581ffbd4fde23be74c956b0359be993ebc436e48a0dab931643aa731
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/de775317-be99-4d74-bc7f-e2eb36ca4716
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1340361
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2cb6e0bd581ffbd4fde23be74c956b0359be993ebc436e48a0dab931643aa731
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2cb6e0bd581ffbd4fde23be74c956b0359be993ebc436e48a0dab931643aa731/
Threat name:
Win32.Trojan.Stealerc
Create hunting rule
Status:
Malicious
First seen:
2023-11-09 22:36:50 UTC
File Type:
PE (Exe)
Extracted files:
75
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fs3obpkyd755j7pchptuzfllanm35gj6xrbw4sfa3k4tczb2u4yq._file
Verdict:
malicious
Result
Malware family:
mystic
Create hunting rule
Score:
  10/10
Tags:
family:mystic evasion persistence stealer trojan
Link:
https://tria.ge/reports/231110-jj97psdg3v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
.NET Reactor proctector
Checks computer location settings
Executes dropped EXE
Windows security modification
Detect Mystic stealer payload
Modifies Windows Defender Real-time Protection settings
Mystic
Unpacked files
SH256 hash:
6cc811f59bdf17c52aa4ab3a76c4a2f0b7276ea9e5d41598876eeb405949cb77
MD5 hash:
03dcb0a8a798ed68c6521c7aca73c404
SHA1 hash:
90cc13515fa4305570c6907f2d2abfd5523c456c
Link:
https://www.unpac.me/results/fcc78f9e-ec42-44d3-9c8e-b3296ad43957/
SH256 hash:
dceba607e20c53433695b13d8e211d8752cf64850f29c4285d8d0d42e57cd8c2
MD5 hash:
1c0664a4735b33938fe2517a8edaab7a
SHA1 hash:
8b53995f0e9d92868afa72cba150c840f2e5522d
Link:
https://www.unpac.me/results/fcc78f9e-ec42-44d3-9c8e-b3296ad43957/
SH256 hash:
b876853e9617678b58405fce2a86a5b36355b58ee7ef9fab6cde7cac622c979e
MD5 hash:
cdd936d08b31d8772cbf3dfa4671a374
SHA1 hash:
716785fa4050d768e5b36d089a695f5525978a01
Link:
https://www.unpac.me/results/fcc78f9e-ec42-44d3-9c8e-b3296ad43957/
SH256 hash:
f3fb13cafe345168b5f7c71556620458c15c76e8f2ca32b0e7d6f2b2f2112f8d
MD5 hash:
3cbba209cc00b2091040841e8874ad54
SHA1 hash:
c575b04d30220666e16a5afd023dca0e4db908f6
Link:
https://www.unpac.me/results/fcc78f9e-ec42-44d3-9c8e-b3296ad43957/
SH256 hash:
aabe348b6c86dcb1d2f1458b04d8cb4a837d9fdbde3fab24d352c0260bfb19c2
MD5 hash:
652133a803b17f771120d37b55aaf318
SHA1 hash:
baa972f4a7bddc4cc4f5034ae3e1ae425b9e3640
Link:
https://www.unpac.me/results/fcc78f9e-ec42-44d3-9c8e-b3296ad43957/
SH256 hash:
2521c0e3614631072d87c4036b8865b80daceb554e0fcd8518fd2e9e51979e42
MD5 hash:
76fe09a911a361d033734a3f39782ce2
SHA1 hash:
1b3a628b38ccfbfee9ee32fe91020c02b7a199e9
Link:
https://www.unpac.me/results/fcc78f9e-ec42-44d3-9c8e-b3296ad43957/
SH256 hash:
2cb6e0bd581ffbd4fde23be74c956b0359be993ebc436e48a0dab931643aa731
MD5 hash:
1e5dc7f4341f9eba06a6b34545b93413
SHA1 hash:
2d7f41a63c580b9b1ffd4ab3674cb94ea93e4ade
Link:
https://www.unpac.me/results/fcc78f9e-ec42-44d3-9c8e-b3296ad43957/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2cb6e0bd581f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2cb6e0bd581ffbd4fde23be74c956b0359be993ebc436e48a0dab931643aa731

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s
Rule name:win_redline_wextract_hunting_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects wextract archives related to redline/amadey

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MysticStealer

Executable exe 2cb6e0bd581ffbd4fde23be74c956b0359be993ebc436e48a0dab931643aa731

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2728937/
  
Delivery method
Distributed via web download

Comments