MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c078f1672e8579d652410aa02ab6ea386a7e22ed78ad50905e823619e1e21149. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c078f1672e8579d652410aa02ab6ea386a7e22ed78ad50905e823619e1e21149
SHA3-384 hash: aa27e1486cdf8b0364de384d7804b67fe35fc86a51be78e7abcd7bf614c2c87812f3aed53813e0f4cb0f8e72727ca68a
SHA1 hash: 5cdc5a5cdc225c70917ca02a767e3fd6e7947210
MD5 hash: ec2f2ebb49b4c9ad2d50bf2ca9c10d66
humanhash: colorado-winter-solar-oscar
File name:file
Download: download sample
Signature MysticStealer
Create hunting rule
File size:1'859'584 bytes
First seen:2023-09-15 03:38:23 UTC
Last seen:2023-09-15 11:57:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 62020f417898af4db9f3ac5ebd561fe6 (4 x RedLineStealer, 2 x MysticStealer)
ssdeep 24576:/MdVrKOpYU/hsYVNQnb3iUBDqd6a9Dhvhe2cl:+rF/hsYVNQ+UI6a3v+
Threatray 454 similar samples on MalwareBazaar
TLSH T1D2851B1176F95B59F6F30FB85ABAA615483AFCAACF11C6DF1251904E0C21BD08970B3B
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe MysticStealer


Avatar
andretavare5
Sample downloaded from http://77.91.68.238/love/no230.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
279
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-09-15 03:41:20 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/9df02a3b-389c-4ee2-bea9-0e7ab6268b29

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448735/
Detection(s):
Win.Malware.Exploitx-9967939-0
Create hunting rule

Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/6503d1d6985359c839077b1f/reports/ed3891ad-920a-4760-b62b-9eee8249eee4/overview
Verdict:
Malicious
Labled as:
TrojanSpy/Stealer.fk
Link:
https://www.hybrid-analysis.com/sample/c078f1672e8579d652410aa02ab6ea386a7e22ed78ad50905e823619e1e21149
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e4f6e504-7770-4750-aff1-7c5f8f24ab8b
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1308689
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c078f1672e8579d652410aa02ab6ea386a7e22ed78ad50905e823619e1e21149/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-09-15 03:39:06 UTC
File Type:
PE (Exe)
AV detection:
17 of 22 (77.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yb4pczzoqv45musbbkqcvnxkhbvh4ixnpcwvbec6qi3btypccfeq._file
Verdict:
malicious
Similar samples:
2887eab305741f7baff6b1f780783cb10f3353d1b42a2aec44fc8f0c323d313e
MysticStealer
3fb9ffe6f9613f18c1e9984787d37a5d9ed4cdc37c628be7cba33d5c37e782aa
MysticStealer
7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79
MysticStealer
854ec17d2916a8fdde780ec93f0f025c38eee71121c5c49fdde436fc9276080c
MysticStealer
b7c5d625ee15f20255a9989081cb9297f429df6f0eaaeaa1e4abbfd4a146e698
MysticStealer
bbac59c3c6a41bfc78a1c6704908d45b0be839280cb7ad41047f870eb298d785
MysticStealer
ca01887f1261ab5d83adc154e7875e2a34916f93771c13a056bda75ee17a07ca
MysticStealer
e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195
MysticStealer
e8f5b878016a7e688e8cc7c9280905c740c0922c4d2e04aae5451569d9faa5fe
MysticStealer
f58a41be919def193aef522bbc727be2a218a2e7b435695c2427e7dc576be977
MysticStealer
+ 444 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230915-d7l7wsge8x/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
928b248eebd2a4396e3566cb4fccadb528e98466c70099995c24c20a2af23e12
MD5 hash:
c20ba7d0ce8cd38ce1a4d4cbad00092a
SHA1 hash:
17f45f0474a956d1be5f2e795b894f31967d97d6
Link:
https://www.unpac.me/results/db67ae75-466d-4a59-b3d2-b483ec07fae0/
SH256 hash:
c078f1672e8579d652410aa02ab6ea386a7e22ed78ad50905e823619e1e21149
MD5 hash:
ec2f2ebb49b4c9ad2d50bf2ca9c10d66
SHA1 hash:
5cdc5a5cdc225c70917ca02a767e3fd6e7947210
Link:
https://www.unpac.me/results/db67ae75-466d-4a59-b3d2-b483ec07fae0/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c078f1672e85/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c078f1672e8579d652410aa02ab6ea386a7e22ed78ad50905e823619e1e21149

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AppLaunch
Create hunting rule
Author:iam-py-test
Description:Detect files referencing .Net AppLaunch.exe
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2710216/
Cape
Cape
https://www.capesandbox.com/analysis/448735/

Comments