MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f49a920c91fc16e71f8424f7b60f9890d79356266b7e8c943de7e105ffc9a117. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MysticStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f49a920c91fc16e71f8424f7b60f9890d79356266b7e8c943de7e105ffc9a117
SHA3-384 hash: f53c3d30a228b1ffb8b7399299b14d73c260004cd009d3aaf8dba5176453bced02833de2bd24b101f6ad732e5c6e3b79
SHA1 hash: d74d1a756f32372bd140ae2fc4e1439ad50c1757
MD5 hash: 199ee02e9857faa1d52c85c0022b5e98
humanhash: juliet-wolfram-echo-sad
File name:file
Download: download sample
Signature MysticStealer
Create hunting rule
File size:364'544 bytes
First seen:2023-09-29 11:58:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 96baacc90461fcd4b5d9fcc50047c098 (37 x MysticStealer, 26 x Amadey, 15 x RedLineStealer)
ssdeep 6144:swTeW/s5GqrO5aXnfEGIXWPvZAOnyBkpPwe0HhO57/vJ3Vs0BC+:AmcGqrOk86xJpPOhO57/v/s0BC+
Threatray 682 similar samples on MalwareBazaar
TLSH T14074CF30B193C873D82A103949E0ABB2556DFAF58DAD097F77ECCBBD5F20680DA11625
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe MysticStealer


Avatar
andretavare5
Sample downloaded from http://77.91.68.239/wase/zor40.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
316
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451975/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.61510.214.16955.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file
Delayed writing of the file
Launching a process
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
Forced shutdown of a system process
Unauthorized injection to a system process
Gathering data
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/6516bc0732ffdb7a7a18d6cf/reports/da9b7633-2d72-497a-b848-246d3b9a6174/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/f49a920c91fc16e71f8424f7b60f9890d79356266b7e8c943de7e105ffc9a117
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eced1497-dca4-42ab-a327-47bb08ce07fa
Result
Threat name:
Mystic Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1316501
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Mystic Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f49a920c91fc16e71f8424f7b60f9890d79356266b7e8c943de7e105ffc9a117/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2023-09-29 11:59:05 UTC
File Type:
PE (Exe)
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6snjeder7qlooh4eet33md4ysdlzgvrgnn7izfb547qql76juelq._file
Verdict:
malicious
Similar samples:
4395f20cb7181a9117515dc843698ae57e92f010068c3f7561f754b5c617bc1b
MysticStealer
885d6abe4ce4819b6ae96807220378f5b48496df0c2908e1965340465d77f77c
MysticStealer
c3da5d3a789a0d72a7273ab2fc33cc228831ba03164667f62232a5ec039832aa
MysticStealer
c6c7cf1fe98df6ad9cef8cc1cb280df3a5a71de48f0ab014f02076791bfa118c
MysticStealer
d331612139ce264eb3770d828b8242a1e04e8a81af38fc3300647deb6a896060
MysticStealer
db88b3051a1aae088cb21fb88d1df75ac86553e6be3ec3903caf4501f05a4211
MysticStealer
eef26490e77fe02338150f05b2134d053736d33b448d2e5309778921cd7cf610
MysticStealer
f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9
MysticStealer
fa96f32dffc26c286f041c805998e70bb94f3ece02d1e791b5b604880aba297c
MysticStealer
+ 672 additional samples on MalwareBazaar
Result
Malware family:
mystic
Create hunting rule
Score:
  10/10
Tags:
family:mystic stealer
Link:
https://tria.ge/reports/230929-n5qseaad3w/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Mystic
Unpacked files
SH256 hash:
033a63ee3b12456eaa45fd39381cdd5b5a0914f0e2a6e5e028775b235a3e152d
MD5 hash:
a261b06141fb8cdd61c07a0b92373fde
SHA1 hash:
b4d94af76652fdd5f48f3774db3d9bed0a461ff5
Link:
https://www.unpac.me/results/f5ebb43f-39d0-4d16-9fb2-3d2afff11e92/
SH256 hash:
f49a920c91fc16e71f8424f7b60f9890d79356266b7e8c943de7e105ffc9a117
MD5 hash:
199ee02e9857faa1d52c85c0022b5e98
SHA1 hash:
d74d1a756f32372bd140ae2fc4e1439ad50c1757
Link:
https://www.unpac.me/results/f5ebb43f-39d0-4d16-9fb2-3d2afff11e92/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f49a920c91fc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f49a920c91fc16e71f8424f7b60f9890d79356266b7e8c943de7e105ffc9a117

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/451975/

Comments