MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba8069bc3fc342c070d151bbc74e504b3ec5aed8d5d45400417040876bdcc3c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba8069bc3fc342c070d151bbc74e504b3ec5aed8d5d45400417040876bdcc3c6
SHA3-384 hash: fc7a5919e96bfcf8aab56cf17ecf328dbcb05995714f61e036e3848d8e9c77919595c6f3c66e4d1a10a04b0e17bc0cbd
SHA1 hash: 505979722f889f0ff6724bfdfb2af6cdcd1b50c6
MD5 hash: e67318b8d3cc0bd90d4cb9d661b750ca
humanhash: monkey-tango-table-fillet
File name:no230-1.exe
Download: download sample
Signature MysticStealer
Create hunting rule
File size:396'288 bytes
First seen:2023-09-12 15:57:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 29c8b785823d6c11cf3aae5ebbb5f0e6 (8 x RedLineStealer, 6 x MysticStealer, 1 x Smoke Loader)
ssdeep 12288:6J82kfMfnuis006jm+uMgxOOWRSmQklVXMjI9:6W2kfGnbsnMQOHSmQklVd
Threatray 4 similar samples on MalwareBazaar
TLSH T12484BF1039E0C172DCBB51374A68FA794A3CBC701BB66AEB67C80D6F8D612D18E355D2
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter Anonymous
Tags:exe MysticStealer


Avatar
Anonymous
http://77.91.68.238/love/no230.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
308
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
no230-1.exe
Verdict:
Malicious activity
Analysis date:
2023-09-12 15:59:46 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/fc381c07-5495-48cc-b9f1-912651b5e1a0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448217/
Detection(s):
Win.Malware.Exploitx-9967939-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Sending a custom TCP request
Unauthorized injection to a system process
Gathering data
Verdict:
Likely Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control greyware lolbin masquerade
Link:
https://www.filescan.io/uploads/65008a54829c3479a05df982/reports/d5278475-e960-4c94-85b7-99d7aaab09bf/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/ba8069bc3fc342c070d151bbc74e504b3ec5aed8d5d45400417040876bdcc3c6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1271bcc4-231d-4576-8a03-4f961474b69d
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1308549
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba8069bc3fc342c070d151bbc74e504b3ec5aed8d5d45400417040876bdcc3c6/
Threat name:
Win32.Trojan.Nekark
Create hunting rule
Status:
Malicious
First seen:
2023-09-12 15:58:06 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkagtpb7ynbma4grkg54otsqjm7mllwy2xkfiacbobaio264ypda._file
Verdict:
unknown
Similar samples:
41c05ce39db4e4e51bfafecc3961a8e77edb6b3f990791b2272338cd37fc6ddf
MysticStealer
5cfaf3fea4ae7c8bf6e7226fd319aeb960a87e8bfb7b15e9c86f220cfa7c5ddc
MysticStealer
8eb05fa1b9d86b092cd2b9dcbdb94413e01d687e84c876668eda5a40c5e7f45b
MysticStealer
fb7e91b56bf53db629541495eabdc88824d23b629d7b8c4d32f6bf24957ceccd
MysticStealer
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230912-tdyxlage49/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
ff5bb0b2d444da2f2b4dc82a2f49e46b6ceac0ee3785a492e48ecbcf1aa07541
MD5 hash:
90af8bdd5d34fd126e143b41691d16cf
SHA1 hash:
a08e5ce49113713669114175e26cdb34e5ba93f2
Link:
https://www.unpac.me/results/d2102465-e4c8-4d0e-a8a6-e0edfcceddd0/
SH256 hash:
ba8069bc3fc342c070d151bbc74e504b3ec5aed8d5d45400417040876bdcc3c6
MD5 hash:
e67318b8d3cc0bd90d4cb9d661b750ca
SHA1 hash:
505979722f889f0ff6724bfdfb2af6cdcd1b50c6
Link:
https://www.unpac.me/results/d2102465-e4c8-4d0e-a8a6-e0edfcceddd0/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ba8069bc3fc3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba8069bc3fc342c070d151bbc74e504b3ec5aed8d5d45400417040876bdcc3c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AppLaunch
Create hunting rule
Author:iam-py-test
Description:Detect files referencing .Net AppLaunch.exe
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MysticStealer

Executable exe ba8069bc3fc342c070d151bbc74e504b3ec5aed8d5d45400417040876bdcc3c6

(this sample)

  
Link
http://77.91.68.238/love/no230.exe
  
URLhaus
https://urlhaus.abuse.ch/url/2710216/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/448217/

Comments