MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81
SHA3-384 hash: 0b941676b984732a541421c17c840587f0d40f8f528379df0049855ee7e9b0c58693ff76c46519a6f298f5575187370f
SHA1 hash: 22f2c6919beb53d4847f841b3ade37a5f57a766b
MD5 hash: da64796b21017581ed9cc9430a994bd6
humanhash: london-nebraska-three-sodium
File name:file
Download: download sample
Signature MysticStealer
Create hunting rule
File size:1'040'384 bytes
First seen:2023-09-28 11:11:52 UTC
Last seen:2023-09-28 11:47:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d215e7ae5c8053185b6f0c1eed2c8e3b (8 x MysticStealer, 4 x RedLineStealer, 1 x N-W0rm)
ssdeep 12288:A+hAoJY0BYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyuxubeg0IVAUjGhzy/9:AY7YDKzcx9jkmPe/knxyZC0gx69
Threatray 672 similar samples on MalwareBazaar
TLSH T190259D21B8849376EEE320B742BCBB7642BDE4B4071556CB06F417EED7606D17B32682
TrID 56.8% (.EXE) InstallShield setup (43053/19/16)
13.8% (.EXE) Win64 Executable (generic) (10523/12/4)
8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:exe MysticStealer


Avatar
andretavare5
Sample downloaded from http://77.91.68.239/wase/zor40.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
324
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451779/
Detection(s):
SecuriteInfo.com.Variant.Babar.72108.10200.1523.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Modifying a system executable file
Delayed writing of the file
Launching a process
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
Infecting executable files
Unauthorized injection to a system process
Gathering data
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/65155f8d43cd377b1ea12614/reports/41a4c6d1-74db-4f7f-86e5-3242d637a1c9/overview
Verdict:
Malicious
Labled as:
Babar.Generic
Link:
https://www.hybrid-analysis.com/sample/344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a62c8692-adbf-47a4-bb19-8d8207f63d11
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1315802
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-09-28 11:12:13 UTC
File Type:
PE (Exe)
AV detection:
15 of 23 (65.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=grhvkw5puezdlrrhk5tccsehvg35o7yghhk3phpsaifnqe4d72aq._file
Verdict:
malicious
Similar samples:
7ccf52e16a13ed7087427bcdb05c85971b0d9796a5884287573166da46ad50f1
MysticStealer
7d99eb634d001b9dc8667d34cf8f0ae1a067e69dbd366e63af156a592017d254
MysticStealer
c3da5d3a789a0d72a7273ab2fc33cc228831ba03164667f62232a5ec039832aa
MysticStealer
c6c7cf1fe98df6ad9cef8cc1cb280df3a5a71de48f0ab014f02076791bfa118c
MysticStealer
d331612139ce264eb3770d828b8242a1e04e8a81af38fc3300647deb6a896060
MysticStealer
db88b3051a1aae088cb21fb88d1df75ac86553e6be3ec3903caf4501f05a4211
MysticStealer
eef26490e77fe02338150f05b2134d053736d33b448d2e5309778921cd7cf610
MysticStealer
f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9
MysticStealer
fa96f32dffc26c286f041c805998e70bb94f3ece02d1e791b5b604880aba297c
MysticStealer
+ 662 additional samples on MalwareBazaar
Result
Malware family:
mystic
Create hunting rule
Score:
  10/10
Tags:
family:mystic stealer
Link:
https://tria.ge/reports/230928-nav4mscc59/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Mystic
Unpacked files
SH256 hash:
033a63ee3b12456eaa45fd39381cdd5b5a0914f0e2a6e5e028775b235a3e152d
MD5 hash:
a261b06141fb8cdd61c07a0b92373fde
SHA1 hash:
b4d94af76652fdd5f48f3774db3d9bed0a461ff5
Link:
https://www.unpac.me/results/e98c0add-4e34-4875-86dd-574853001b41/
SH256 hash:
344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81
MD5 hash:
da64796b21017581ed9cc9430a994bd6
SHA1 hash:
22f2c6919beb53d4847f841b3ade37a5f57a766b
Link:
https://www.unpac.me/results/e98c0add-4e34-4875-86dd-574853001b41/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/344f555bafa1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/451779/

Comments