MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e0133342dd974522307833d0cbdba4f09ccc7380fc232808a3511a6e766c49b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e0133342dd974522307833d0cbdba4f09ccc7380fc232808a3511a6e766c49b
SHA3-384 hash: 967fb95701f05199d8ab7177f0012763601ea279fc54006b72576ea5b74258993bf69cd2a9470f23934314d04526f7d1
SHA1 hash: 53f0bb85521cb18a18aaa639e101f7d46fa1f640
MD5 hash: f2f137221ef1d20a79604e784628f7cf
humanhash: oxygen-thirteen-finch-summer
File name:SecuriteInfo.com.Trojan.Inject4.60850.24794.27413
Download: download sample
Signature MysticStealer
Create hunting rule
File size:270'848 bytes
First seen:2023-09-08 00:29:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 431b9eee3827e493b6144e5f38c219a4 (15 x MysticStealer, 8 x RedLineStealer, 6 x Smoke Loader)
ssdeep 6144:V76PWA9nd1kCh2EongY20s4DdggRSAERI35ay4Z:VmPHkCyRs4R1wEj4Z
Threatray 615 similar samples on MalwareBazaar
TLSH T17444BEC079F24C3EDBB165724D60B6AAA94DF0200E84D54F33D517E88A6E6C2741EFA7
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:exe MysticStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
282
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.Inject4.60850.24794.27413
Verdict:
Malicious activity
Analysis date:
2023-09-08 00:32:04 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/9d3fd0a3-b999-4c4f-a88c-d2212b75f23b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/447311/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.60850.24794.27413.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/64fa6b0b003a02a1c090ab15/reports/a03aaf89-3919-4e4a-94cf-25a89fe4a8be/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/7e0133342dd974522307833d0cbdba4f09ccc7380fc232808a3511a6e766c49b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/f46c9b1e-8df8-4706-9153-6796509c5244
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1305872
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e0133342dd974522307833d0cbdba4f09ccc7380fc232808a3511a6e766c49b/
Threat name:
Win32.Trojan.Nekark
Create hunting rule
Status:
Malicious
First seen:
2023-09-08 00:30:06 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pyatgnbn3f2feiyhqm6qzpn2j4e4zrzyb7bdfaekgui2nz3gysnq._file
Verdict:
malicious
Similar samples:
19bf92ede148d3bb07ed38d5c8a8d07c1d30ac5607d24a7f417684070c10c235
MysticStealer
34f4adf3311c95f94e81cbc03d336101fb497ba01eca33e6c4656b9e56514563
MysticStealer
5fa9d9b71791483ca380f09e1fc946b0ba7d68cfb73147bf80aa472b72497ef3
MysticStealer
62ecea35a4840c0e54486e3ea0773420fa01eef25b0d961977dcc6f9637c4f39
MysticStealer
9031a8646ed7e86fe86bfc4ebcf9d466de309a3d7d9f96c1085d7bfa66239d0e
MysticStealer
9f78f23917333e4e4ee095e36f159d24d29117296c458b748831d4c0ede6b938
MysticStealer
b54a4c208ffaa8d691efa0e946eb7e359f03bbe06c55ef22625bce64684bfeec
MysticStealer
c062d589d7d1620d80b5b5d5bc42616181da55be9cdafed8f05d222369bf03a8
MysticStealer
d1ba965ef3114ff1fffe3eff2a3c0241d7efdef8b76ee3f1f0674ec30d4cc9ba
MysticStealer
d5347f2a5056605c06d2dabc9b6835719f8d96bca47b2f25bea632fee255f268
MysticStealer
+ 605 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230908-atgtgaff7w/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
26251f26cec6a8ac056686e7997df73c96432ec3a3d839dbb3039222fe686f35
MD5 hash:
d2c44de6b26bbf79cee8666cb0b1acd6
SHA1 hash:
8607fe5ab88296c6745a2c5d90fb474d13a1df2e
Link:
https://www.unpac.me/results/fbfa45ea-8b15-4efa-a226-d18b657cca0f/
SH256 hash:
7e0133342dd974522307833d0cbdba4f09ccc7380fc232808a3511a6e766c49b
MD5 hash:
f2f137221ef1d20a79604e784628f7cf
SHA1 hash:
53f0bb85521cb18a18aaa639e101f7d46fa1f640
Link:
https://www.unpac.me/results/fbfa45ea-8b15-4efa-a226-d18b657cca0f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7e0133342dd9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7e0133342dd974522307833d0cbdba4f09ccc7380fc232808a3511a6e766c49b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AppLaunch
Create hunting rule
Author:iam-py-test
Description:Detect files referencing .Net AppLaunch.exe
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/447311/

Comments