MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e75a7da5d11515731f461a52d8e083e2f46b7101d2d70077ba4a83e5757d9f96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e75a7da5d11515731f461a52d8e083e2f46b7101d2d70077ba4a83e5757d9f96
SHA3-384 hash: 2a546c25fcbe467587a7c139b84263d96a22664bf153cca36e5a814fa0053792e0e967165446c0bf475e8b27b800c2fe
SHA1 hash: f40b80d228806d4ce1380737eace3d82bf70ec8c
MD5 hash: 3e1eb53dcf1c0378f4afa2eed59ae817
humanhash: sink-fix-nitrogen-nebraska
File name:file
Download: download sample
Signature MysticStealer
Create hunting rule
File size:282'624 bytes
First seen:2023-09-30 14:00:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b961e24b82512d2a00ac6c970dad1c8 (9 x MysticStealer, 5 x RedLineStealer, 4 x Smoke Loader)
ssdeep 6144:WhZk644xW4P8t6qe0lNvLpVYC8W9SXowf9Sj:W4644xWRlZpVYCD9SY1j
Threatray 767 similar samples on MalwareBazaar
TLSH T10554C06279D18C3EE921E43B8630FC90457AE4BB0BD259E7827C353A7EB42D5047BD62
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe MysticStealer


Avatar
andretavare5
Sample downloaded from http://77.91.68.239/wase/zor40.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
296
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/452297/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.20760.28615.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
DNS request
Unauthorized injection to a system process
Gathering data
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/65182a1ff1b40cb0d624fce4/reports/2ade7b2f-e2ac-4690-b3ad-a295cbc5d16c/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/e75a7da5d11515731f461a52d8e083e2f46b7101d2d70077ba4a83e5757d9f96
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3e581cb7-d901-4a93-b997-25be14835a18
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1317209
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e75a7da5d11515731f461a52d8e083e2f46b7101d2d70077ba4a83e5757d9f96/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-09-30 14:01:06 UTC
File Type:
PE (Exe)
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=45nh3jorcukxgh2gdjjnryed4l2gw4ib2llqa552jkb6k5l5t6la._file
Verdict:
malicious
Similar samples:
2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08
MysticStealer
418e70dd57c4f7e10aecb70fa71f02ebbce59ab94174b5e73f48d66fb51a64a2
MysticStealer
579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20
MysticStealer
649ac055bd38afccc57c2adeecc033c6ac1e845c51296b05e861cbe10c6e2999
MysticStealer
79561cbf51e95506570ae9ca905cbaf9ed78d80c0394dab064efd8e713509af1
MysticStealer
7cb01016999849441abca4e084af74755a5fae1bbbfdaf8bcb9203917b777a72
MysticStealer
889aa399b0ef267897b65a16b78e2184cb6bb7f8862f578c9758d784b3ec8446
MysticStealer
b8ce48f350bb5090bc18e3f8b5be5efb9da48e6c48868e405397c000992aaf53
MysticStealer
d400ae8368680805e1172303d27358f44dc6428ff6a304622bd43f79956fb0d4
MysticStealer
f6fe747d4556c1ec20ce3d660acb836ed20ab56825287c334a206613295845e1
MysticStealer
+ 757 additional samples on MalwareBazaar
Result
Malware family:
mystic
Create hunting rule
Score:
  10/10
Tags:
family:mystic stealer
Link:
https://tria.ge/reports/230930-rbjc1sed64/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Mystic
Unpacked files
SH256 hash:
69c3c07646fee6357420e43f14db68b57af322b522367e148f601a6bb6af1bbd
MD5 hash:
e7ebba2a615bf0a8458bcefbc7c5c827
SHA1 hash:
5cabb23245c346b70a22753e26402a091bfd1022
Link:
https://www.unpac.me/results/1c9dc145-000e-4a26-9318-8518bdcc85cc/
SH256 hash:
e75a7da5d11515731f461a52d8e083e2f46b7101d2d70077ba4a83e5757d9f96
MD5 hash:
3e1eb53dcf1c0378f4afa2eed59ae817
SHA1 hash:
f40b80d228806d4ce1380737eace3d82bf70ec8c
Link:
https://www.unpac.me/results/1c9dc145-000e-4a26-9318-8518bdcc85cc/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e75a7da5d115/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e75a7da5d11515731f461a52d8e083e2f46b7101d2d70077ba4a83e5757d9f96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/452297/

Comments