MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79ef567563963d9b5c05825ad9c4d4a5a18ec8f0325f9d133bac910ddb2b1aab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79ef567563963d9b5c05825ad9c4d4a5a18ec8f0325f9d133bac910ddb2b1aab
SHA3-384 hash: 0c37474fb3882234ffd84fdc5dd4ce4fb625b78f016488bfe28153b747b4bcb6f6d0fdb3784f4e036b6439c7bf846ff0
SHA1 hash: b5049f6c1d00323e05011ef28d056c60189a8802
MD5 hash: 834a9fe33967ac57c9b3ed81a694a04f
humanhash: undress-victor-white-florida
File name:SecuriteInfo.com.Trojan.Inject4.61280.16048.26397
Download: download sample
Signature MysticStealer
Create hunting rule
File size:717'176 bytes
First seen:2023-09-21 19:31:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f15d7c61281219835473a0dcb1929653 (35 x MysticStealer, 5 x RedLineStealer, 3 x Smoke Loader)
ssdeep 6144:K6vPALOgBE8y8wl5zNci/6VucQZHH9rt6MCOLaqnQrL3bvBxk3qPq16UHlDsr:DgOgxyKVucQZ9h63qoTPRr
Threatray 245 similar samples on MalwareBazaar
TLSH T1A1E4AF1074A042B3FCF254B606EC7B354EADE8F01F4559CB16D81BEED6206C1BB36A5A
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:exe MysticStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
269
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/450489/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.61280.16048.26397.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/650c9a3234be449f01183b7e/reports/36ef522d-2627-485e-b2c5-4daf46cdd648/overview
Verdict:
Malicious
Labled as:
Troj/Krypt
Link:
https://www.hybrid-analysis.com/sample/79ef567563963d9b5c05825ad9c4d4a5a18ec8f0325f9d133bac910ddb2b1aab
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Sysinternals
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/7cad2904-90ee-4593-8ee6-91dc47ccff30
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1312593
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79ef567563963d9b5c05825ad9c4d4a5a18ec8f0325f9d133bac910ddb2b1aab/
Threat name:
Win32.Trojan.MysticStealer
Create hunting rule
Status:
Malicious
First seen:
2023-09-21 19:32:05 UTC
File Type:
PE (Exe)
AV detection:
17 of 22 (77.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=phxvm5ldsy6zwxafqjnntrguuwqy5shqgjpz2ez3vsiq3wzldkvq._file
Verdict:
unknown
Similar samples:
38bf240eaa89c43f4aebcfbcef9b12669417c9b9a9aa60fb5cf4a916e2889bff
MysticStealer
4adce3703406ddd76f486198dcc8932b1ad17119e77340543dfc347e705adb88
MysticStealer
710e50bedb77792743e3e5389f609110ea064c3fe50cd1e35242b9db53101a0c
MysticStealer
969858a1d4ca4c9fcc44f5d3a688bd460c9fe118f2b854e03640c5c2a4f78fa5
MysticStealer
c4e0cb607d432343219b41d78c2ec5dd75cd61337e01004ddbd2a25678afd2f2
MysticStealer
d65457967ab5ef2ac43c210821d99a3ccdfe8fdc07c7eedb79c577ac06aaac84
MysticStealer
d8c3fa92ed236454106a3392ce00dd820c8b69f284f293603240ffb1a5a593a3
MysticStealer
e3cabefa48d70d737194e71275e2ecba91380dc6af1e4b0615d7e05e3499c8c9
MysticStealer
e3cb5911ee3e585999a4e90ab561746e1704b590d0b5422a6fac0dbfe10b0f1a
MysticStealer
fb536e35b2dffa546ddc963fe30734746b7aee6abb7c6ce1553c38db97c37377
MysticStealer
+ 235 additional samples on MalwareBazaar
Result
Malware family:
mystic
Create hunting rule
Score:
  10/10
Tags:
family:mystic stealer
Link:
https://tria.ge/reports/230921-x8x6bsab2w/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Mystic
Unpacked files
SH256 hash:
181b3a2ecf70826f833d5ab235ca8c18411fb1eae9bd8f6aafe08157f8877389
MD5 hash:
dfb3beca6f4af7a5ee9089538fc44209
SHA1 hash:
a2c30367c4a8479ce05f5d887a4ac6000b236b57
Link:
https://www.unpac.me/results/8e0c05e2-0438-4ca3-bd97-858d57bcd9cb/
SH256 hash:
79ef567563963d9b5c05825ad9c4d4a5a18ec8f0325f9d133bac910ddb2b1aab
MD5 hash:
834a9fe33967ac57c9b3ed81a694a04f
SHA1 hash:
b5049f6c1d00323e05011ef28d056c60189a8802
Link:
https://www.unpac.me/results/8e0c05e2-0438-4ca3-bd97-858d57bcd9cb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/79ef56756396/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79ef567563963d9b5c05825ad9c4d4a5a18ec8f0325f9d133bac910ddb2b1aab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/450489/

Comments