MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34c748ea2ad85363bf38a50a0d8cd6933156373e96c282da49d64366de1e4837. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34c748ea2ad85363bf38a50a0d8cd6933156373e96c282da49d64366de1e4837
SHA3-384 hash: 6ed8572f0d0affce01e3b91b834b77fd3334904ec9368920b6586633382471bf181e7847487da7234d798cb040bca71b
SHA1 hash: ce95b81a2e3c6bfa79dfb683e2bde351034847da
MD5 hash: f5af726588695b312ff36e46c25c9a39
humanhash: moon-vermont-illinois-angel
File name:file
Download: download sample
Signature MysticStealer
Create hunting rule
File size:374'272 bytes
First seen:2023-09-18 17:57:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 36723152dcc89be0d0104bd374001ada (74 x MysticStealer, 4 x RedLineStealer, 1 x Amadey)
ssdeep 6144:rlwjEl2jicP5iOo2T8VrSd/sUAORUl2A90sdasRsOAZZU5hqJnEcXtYG1Sa:rlwMqiG59ouDUECFsOAzUiJ1Sa
Threatray 522 similar samples on MalwareBazaar
TLSH T10C84BF8175A18072D8331CF64AFCDBF6852DB4630A5609EF17941EBE4F21AF3A3B1256
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:exe MysticStealer


Avatar
andretavare5
Sample downloaded from http://77.91.68.238/love/no230.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
293
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-09-18 17:57:48 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/0c621c2a-4778-41cd-9ef1-dcff26740efe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/449427/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.61167.13802.25688.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Creating a file in the %temp% directory
Unauthorized injection to a system process
Gathering data
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/65088f6f988a26b6d96e5801/reports/592ce5a0-5a5a-42c6-8e80-a513ea73b4ee/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/34c748ea2ad85363bf38a50a0d8cd6933156373e96c282da49d64366de1e4837
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f5ce1085-be12-4c7c-9445-5cf6178e798f
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1310259
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34c748ea2ad85363bf38a50a0d8cd6933156373e96c282da49d64366de1e4837/
Threat name:
Win32.Trojan.Stealerc
Create hunting rule
Status:
Malicious
First seen:
2023-09-18 17:57:06 UTC
File Type:
PE (Exe)
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gtdur2rk3bjwhpzyuufa3dgwsmyvmnz6s3bifwsj2zbwnxq6ja3q._file
Verdict:
malicious
Similar samples:
1b4f869d662e4a6c96c415395e7702ea2b0343efc9eff1e40e25bc1f52b4efd5
MysticStealer
4578c742a5f65b98222dc0ea0cf056d03ae552c0914564dfd8a09b297e3544f8
MysticStealer
63dc80c95e350b9722e4132f2456d57f346cb362029e506ebad41e308b9f0418
MysticStealer
6ae5cbcfe47e3f76e33f2a1e936036dda580b9e5aedb242ca28df0f1f056ea6b
MysticStealer
8653efc33615e4cd6946f561ebde231f0c963988ba91098513f9985345ae2385
MysticStealer
8e7adf851319e10b5d3bf362173ded2def6dfcdfc322debf9135abd8e8995ab7
MysticStealer
9775e909b6ba80b037e76499a993042e672800a07541516339a844346af0ba51
MysticStealer
b89e6e7870c09b48229d5ce0bf73594d0f7f66e9d739e83be46af6afba5adda8
MysticStealer
bbe39345895cdaa196904e095fc9e5f7075db082d3e507cf5c1f55d4867c515a
MysticStealer
e27415e4ef6d2e24e66086800d8060678e3ffc65eb864f6ef872cfa52b6c00e5
MysticStealer
+ 512 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230918-wjky2adg45/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c542f888ac01d2b3476b3e68e97e4b45c3ecbc5c7c86d58068fc073dcfa9261e
MD5 hash:
38d82f87ad1b4c6d0787bc2e7ad6f26e
SHA1 hash:
29c3de119f81e49e2ce60990310d2991dc2fc796
Link:
https://www.unpac.me/results/e2231de4-6b92-44a6-bece-56d7b9cbef2d/
SH256 hash:
34c748ea2ad85363bf38a50a0d8cd6933156373e96c282da49d64366de1e4837
MD5 hash:
f5af726588695b312ff36e46c25c9a39
SHA1 hash:
ce95b81a2e3c6bfa79dfb683e2bde351034847da
Link:
https://www.unpac.me/results/e2231de4-6b92-44a6-bece-56d7b9cbef2d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/34c748ea2ad8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/34c748ea2ad85363bf38a50a0d8cd6933156373e96c282da49d64366de1e4837

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AppLaunch
Create hunting rule
Author:iam-py-test
Description:Detect files referencing .Net AppLaunch.exe
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/449427/

Comments