MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcda132b6230809b65aa53fc7ac3b5ea6b0b706c4ce1cc2f303821fbd348e964. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcda132b6230809b65aa53fc7ac3b5ea6b0b706c4ce1cc2f303821fbd348e964
SHA3-384 hash: 5658c5d29a218d0c6cc31eb925487afcad583feffb628bfe75d26f997a2ce5cbfca0c0d142155f7373942746998b1608
SHA1 hash: ae7479eaeff8a938afb6376b2c8e4e2af807a3ad
MD5 hash: 0ee869d07fbe3dcd00790b0009f84427
humanhash: lemon-massachusetts-delta-shade
File name:file
Download: download sample
Signature MysticStealer
Create hunting rule
File size:374'272 bytes
First seen:2023-09-18 17:04:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 36723152dcc89be0d0104bd374001ada (74 x MysticStealer, 4 x RedLineStealer, 1 x Amadey)
ssdeep 6144:zbtjEY2jicP5iOo2T8VrSd/sUAOhUlNOt/DliduKb4FCpBn9xo1Sa:zbt1qiG59ouLUirMdumHp/+1Sa
Threatray 585 similar samples on MalwareBazaar
TLSH T18484BF84B7B18572D46204322DE1937D497E7D3446A26EEB23E31BEE5E603C0E7315EA
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:exe MysticStealer


Avatar
andretavare5
Sample downloaded from http://77.91.68.238/love/no230.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
306
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-09-18 17:05:48 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/3253b50c-04c3-4531-82d6-56cfd52d65e0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/449420/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.4745.19568.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Creating a file in the %temp% directory
Sending a custom TCP request
Unauthorized injection to a system process
Gathering data
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/6508833f83a0c6425df8926e/reports/d2784ad4-621c-4c97-b5bd-56c4dd1983b0/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/dcda132b6230809b65aa53fc7ac3b5ea6b0b706c4ce1cc2f303821fbd348e964
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b19f6cd4-505d-41f9-a5ba-63aad65a107d
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1310237
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcda132b6230809b65aa53fc7ac3b5ea6b0b706c4ce1cc2f303821fbd348e964/
Threat name:
Win32.Trojan.Stealerc
Create hunting rule
Status:
Malicious
First seen:
2023-09-18 17:05:06 UTC
File Type:
PE (Exe)
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3tnbgk3cgcajwznkkp6hvq5v5jvqw4dmjtq4ylzqhaq7xu2i5fsa._file
Verdict:
malicious
Similar samples:
13151d325a3b1e3e5a3c083f21fe6de58d1e1304b47ee6c3ed0432b9a39b480c
MysticStealer
1b4f869d662e4a6c96c415395e7702ea2b0343efc9eff1e40e25bc1f52b4efd5
MysticStealer
52014522ed8315114fc8fc71e9445030da55256cf109aaec46a40843097b2cd0
MysticStealer
6328c47f5252c43b01a9d2e90174bdb6809f099035f084c1bcf6f1323f001952
MysticStealer
63dc80c95e350b9722e4132f2456d57f346cb362029e506ebad41e308b9f0418
MysticStealer
6ae5cbcfe47e3f76e33f2a1e936036dda580b9e5aedb242ca28df0f1f056ea6b
MysticStealer
8653efc33615e4cd6946f561ebde231f0c963988ba91098513f9985345ae2385
MysticStealer
8e7adf851319e10b5d3bf362173ded2def6dfcdfc322debf9135abd8e8995ab7
MysticStealer
9775e909b6ba80b037e76499a993042e672800a07541516339a844346af0ba51
MysticStealer
9871bad0fe503c40a0eab3cf108ac0a92b390af6ff5022a1760d388719642672
MysticStealer
+ 575 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230918-vlttaaah2v/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c542f888ac01d2b3476b3e68e97e4b45c3ecbc5c7c86d58068fc073dcfa9261e
MD5 hash:
38d82f87ad1b4c6d0787bc2e7ad6f26e
SHA1 hash:
29c3de119f81e49e2ce60990310d2991dc2fc796
Link:
https://www.unpac.me/results/ed1347e8-ebc0-4b1b-8854-188d1181399f/
SH256 hash:
dcda132b6230809b65aa53fc7ac3b5ea6b0b706c4ce1cc2f303821fbd348e964
MD5 hash:
0ee869d07fbe3dcd00790b0009f84427
SHA1 hash:
ae7479eaeff8a938afb6376b2c8e4e2af807a3ad
Link:
https://www.unpac.me/results/ed1347e8-ebc0-4b1b-8854-188d1181399f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dcda132b6230/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dcda132b6230809b65aa53fc7ac3b5ea6b0b706c4ce1cc2f303821fbd348e964

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AppLaunch
Create hunting rule
Author:iam-py-test
Description:Detect files referencing .Net AppLaunch.exe
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/449420/

Comments