MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 710e50bedb77792743e3e5389f609110ea064c3fe50cd1e35242b9db53101a0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 710e50bedb77792743e3e5389f609110ea064c3fe50cd1e35242b9db53101a0c
SHA3-384 hash: 933a90ea7b4d6b8816719cd36fd59762de611709d6793a3fc59e39081aea4d76910dd8683e148ad209d535a6b3220a68
SHA1 hash: af164f481ec4c586577cb717791cec7eaf863542
MD5 hash: a1c3cfd1d32f8af2dca5afbd770c8822
humanhash: india-alaska-fillet-coffee
File name:SecuriteInfo.com.Win32.DropperX-gen.10940.10905
Download: download sample
Signature MysticStealer
Create hunting rule
File size:717'176 bytes
First seen:2023-09-21 14:40:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f15d7c61281219835473a0dcb1929653 (35 x MysticStealer, 5 x RedLineStealer, 3 x Smoke Loader)
ssdeep 6144:J6vGALXgBEIy8wluzNcq/PVucQpfMjgxL60UPBBQYXmZ9rduYUK5FR6idkIM0vfr:kHXgFysVucQpfMcx3MHmZ9rkuPR6QOAr
Threatray 227 similar samples on MalwareBazaar
TLSH T16FE49E2074A281B6ECE224B613DC7AF141AEE4F0CB5556DF07DC4BFAE2201C16A757A7
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:exe MysticStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/450408/
Detection(s):
SecuriteInfo.com.Win32.DropperX-gen.10940.10905.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/650c560283a0c6425dfb908a/reports/75345cc1-812e-48a6-a0b4-120d8e880c91/overview
Verdict:
Malicious
Labled as:
Troj/Krypt
Link:
https://www.hybrid-analysis.com/sample/710e50bedb77792743e3e5389f609110ea064c3fe50cd1e35242b9db53101a0c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Sysinternals
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6303604b-c617-4a98-a521-dfce2394186f
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1312386
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/710e50bedb77792743e3e5389f609110ea064c3fe50cd1e35242b9db53101a0c/
Threat name:
Win32.Trojan.MysticStealer
Create hunting rule
Status:
Malicious
First seen:
2023-09-21 14:41:08 UTC
File Type:
PE (Exe)
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oehfbpw3o54soq7d4u4j6yercdvamtb74ugndy2sik45wuyqdiga._file
Verdict:
unknown
Similar samples:
17874d042ca52b918e577180116a6ba514ac9b28f78b93390c15667bfbd907b7
MysticStealer
20969bec03dc40390846880b5b478385bc40a83d2ee1076ead7dbe05a18bb917
MysticStealer
386cd47f4060dc5fb5186c8257f778653e2ce2c9b42edcc44f0b5d27953b3d0a
MysticStealer
3c9d50d6791011c6b0c5e8496f6764bafbd43a7a5d7d066339f5d2934b2e92e7
MysticStealer
41127a0dd4f3be76754f36402f6a1cf140927a76b1ab17e4fae8316667732325
MysticStealer
4adce3703406ddd76f486198dcc8932b1ad17119e77340543dfc347e705adb88
MysticStealer
c24740dcd219e014f566641c26b8b67864156d4e915867fa37d93d0b514f871a
MysticStealer
ce8c9483ccfee44272881aa17481ac3928048ab93e9de22e60e339c4c348efd0
MysticStealer
d91dbe7098f37ae7b86aa0a328fca18860dc7e9171fea3e07643b032ae1c5a5d
MysticStealer
e3cb5911ee3e585999a4e90ab561746e1704b590d0b5422a6fac0dbfe10b0f1a
MysticStealer
+ 217 additional samples on MalwareBazaar
Result
Malware family:
mystic
Create hunting rule
Score:
  10/10
Tags:
family:mystic stealer
Link:
https://tria.ge/reports/230921-r2e4aagg3s/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Mystic
Unpacked files
SH256 hash:
181b3a2ecf70826f833d5ab235ca8c18411fb1eae9bd8f6aafe08157f8877389
MD5 hash:
dfb3beca6f4af7a5ee9089538fc44209
SHA1 hash:
a2c30367c4a8479ce05f5d887a4ac6000b236b57
Link:
https://www.unpac.me/results/aec3bd46-9b02-4402-85b8-3fed307af083/
SH256 hash:
710e50bedb77792743e3e5389f609110ea064c3fe50cd1e35242b9db53101a0c
MD5 hash:
a1c3cfd1d32f8af2dca5afbd770c8822
SHA1 hash:
af164f481ec4c586577cb717791cec7eaf863542
Link:
https://www.unpac.me/results/aec3bd46-9b02-4402-85b8-3fed307af083/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/710e50bedb77/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/710e50bedb77792743e3e5389f609110ea064c3fe50cd1e35242b9db53101a0c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/450408/

Comments