fa608193e8f5c475f7120317f319eb77ea199ddb7d8ddef58b4580181d4b763b
PE
Verdict: HOSTILE
AI
Stealer with anti-analysis and importless loader
Local reference
Suspicious dependency
Inferred
| 0x0 |
4d5a90000300000004000000ffff0000 |
MZ..............Importless PE combines PEB or NT anti-debugging with executable memory |
| 0x10 |
b8000000000000004000000000000000 |
........@....... |
| 0x20 |
00000000000000000000000000000000 |
................ |
| 0x30 |
00000000000000000000000080020000 |
................ |
| 0x40 |
0e1fba0e00b409cd21b8014ccd215468 |
........!..L.!Th |
| 0x50 |
69732070726f6772616d2063616e6e6f |
is program canno |
| 0x60 |
742062652072756e20696e20444f5320 |
t be run in DOS |
| 0x70 |
6d6f64652e0d0d0a2400000000000000 |
mode....$....... |
| 0x80 |
58d22d721cb343211cb343211cb34321 |
X.-r..C!..C!..C! |
| 0x90 |
d4c640201d |
..@ . |
| 0x14a0 |
62e8fe8a0800488b5d58488bd04c8bc3 |
b.....H.]XH..L.. |
| 0x14b0 |
41b940000000498bcde802a70f00e835 |
A.@...I........5Importless PE resolves APIs through a PEB hash loader |
| 0x14c0 |
8d0800488bd04c8d434041b980000000 |
...H..L.C@A..... |
| 0x14d0 |
498b |
I. |
| 0x49de |
587d33db498943184c8bc9c644246652 |
X}3.I.C.L...D$fR |
| 0x49ee |
65488b0425600000004885c90f849300 |
eH..%`...H......Importless PE combines PEB or NT anti-debugging with executable memory |
| 0x49fe |
000085d20f8e8b0000004885c00f8482 |
..........H..... |
| 0x4a0e |
000000488b40204885c074794c8b5868 |
...H.@ H..tyL.Xh |
| 0x4a1e |
4d85db74706639586074 |
M..tpf9X`t |
| 0x6144 |
0300004981f217885a224c8954246044 |
...I....Z"L.T$`D |
| 0x6154 |
8b4b3c4533c0c7859003000082cba29b |
.K<E3...........Importless PE resolves APIs through a PEB hash loader |
| 0x6164 |
8b8d900300008b8590030000c1f91f33 |
...............3 |
| 0x6174 |
c149 |
.I |
| 0x104b7 |
8bc3b901000000e84d24ffff8d041f41 |
........M$.....A |
| 0x104c7 |
ba070000008986002000004c8d45dcc7 |
........ ..L.E..Importless PE combines PEB or NT anti-debugging with executable memory |
| 0x104d7 |
45d824362ce74c8d4dd8c745dc280d82 |
E.$6,.L.M..E.(.. |
| 0x104e7 |
22c745e0e5546322c745e45575ff |
".E..Tc".E.Uu. |
Objectives
| 0x104b7 |
8bc3b901000000e84d24ffff8d041f41 |
........M$.....A |
| 0x104c7 |
ba070000008986002000004c8d45dcc7 |
........ ..L.E.. |
| 0x104d7 |
45d824362ce74c8d4dd8c745dc280d82 |
E.$6,.L.M..E.(.. |
| 0x104e7 |
22c745e0e5546322c745e45575ff |
".E..Tc".E.Uu. |
| 0x0 |
4d5a90000300000004000000ffff0000 |
MZ.............. |
| 0x10 |
b8000000000000004000000000000000 |
........@....... |
| 0x20 |
00000000000000000000000000000000 |
................ |
| 0x30 |
00000000000000000000000080020000 |
................ |
| 0x40 |
0e1fba0e00b409cd21b8014ccd215468 |
........!..L.!Th |
| 0x50 |
69732070726f6772616d2063616e6e6f |
is program canno |
| 0x60 |
742062652072756e20696e20444f5320 |
t be run in DOS |
| 0x70 |
6d6f64652e0d0d0a2400000000000000 |
mode....$....... |
| 0x80 |
58d22d721cb343211cb343211cb34321 |
X.-r..C!..C!..C! |
| 0x90 |
d4c640201d |
..@ . |
| 0x14a0 |
62e8fe8a0800488b5d58488bd04c8bc3 |
b.....H.]XH..L.. |
| 0x14b0 |
41b940000000498bcde802a70f00e835 |
A.@...I........5 |
| 0x14c0 |
8d0800488bd04c8d434041b980000000 |
...H..L.C@A..... |
| 0x14d0 |
498b |
I. |
| 0x49de |
587d33db498943184c8bc9c644246652 |
X}3.I.C.L...D$fR |
| 0x49ee |
65488b0425600000004885c90f849300 |
eH..%`...H...... |
| 0x49fe |
000085d20f8e8b0000004885c00f8482 |
..........H..... |
| 0x4a0e |
000000488b40204885c074794c8b5868 |
...H.@ H..tyL.Xh |
| 0x4a1e |
4d85db74706639586074 |
M..tpf9X`t |
| 0x3510c |
00ba3a010000488d4c2420e8d4a50a00 |
..:...H.L$ ..... |
| 0x3511c |
41b840000000488d942470010000488b |
A.@...H..$p...H. |
| 0x3512c |
8c2460010000e8b570feffb801000000 |
.$`.....p....... |
| 0x3513c |
486b |
Hk |
| 0x1d5c9 |
00486bc01ec6440440c7b80100000048 |
.Hk...D.@......H |
| 0x1d5d9 |
6bc01fc6440440e4b801000000486bc0 |
k...D.@......Hk. |
| 0x1d5e9 |
20c6440440beb801000000486bc021c6 |
.D.@......Hk.!. |
| 0x1d5f9 |
4404 |
D. |
| 0x49de |
587d33db498943184c8bc9c644246652 |
X}3.I.C.L...D$fR |
| 0x49ee |
65488b0425600000004885c90f849300 |
eH..%`...H...... |
| 0x49fe |
000085d20f8e8b0000004885c00f8482 |
..........H..... |
| 0x4a0e |
000000488b40204885c074794c8b5868 |
...H.@ H..tyL.Xh |
| 0x4a1e |
4d85db74706639586074 |
M..tpf9X`t |
| 0x0 |
4d5a90000300000004000000ffff0000 |
MZ.............. |
| 0x10 |
b8000000000000004000000000000000 |
........@....... |
| 0x20 |
00000000000000000000000000000000 |
................ |
| 0x30 |
00000000000000000000000080020000 |
................ |
| 0x40 |
0e1fba0e00b409cd21b8014ccd215468 |
........!..L.!Th |
| 0x50 |
69732070726f6772616d2063616e6e6f |
is program canno |
| 0x60 |
742062652072756e20696e20444f5320 |
t be run in DOS |
| 0x70 |
6d6f64652e0d0d0a2400000000000000 |
mode....$....... |
| 0x80 |
58d22d721cb343211cb343211cb34321 |
X.-r..C!..C!..C! |
| 0x90 |
d4c640201d |
..@ . |
| 0x14a0 |
62e8fe8a0800488b5d58488bd04c8bc3 |
b.....H.]XH..L.. |
| 0x14b0 |
41b940000000498bcde802a70f00e835 |
A.@...I........5 |
| 0x14c0 |
8d0800488bd04c8d434041b980000000 |
...H..L.C@A..... |
| 0x14d0 |
498b |
I. |
| 0x6144 |
0300004981f217885a224c8954246044 |
...I....Z"L.T$`D |
| 0x6154 |
8b4b3c4533c0c7859003000082cba29b |
.K<E3........... |
| 0x6164 |
8b8d900300008b8590030000c1f91f33 |
...............3 |
| 0x6174 |
c149 |
.I |
| 0x3510c |
00ba3a010000488d4c2420e8d4a50a00 |
..:...H.L$ ..... |
| 0x3511c |
41b840000000488d942470010000488b |
A.@...H..$p...H. |
| 0x3512c |
8c2460010000e8b570feffb801000000 |
.$`.....p....... |
| 0x3513c |
486b |
Hk |
Micro-behaviors
| 0x6144 |
0300004981f217885a224c8954246044 |
...I....Z"L.T$`D |
| 0x6154 |
8b4b3c4533c0c7859003000082cba29b |
.K<E3........... |
| 0x6164 |
8b8d900300008b8590030000c1f91f33 |
...............3 |
| 0x6174 |
c149 |
.I |
| 0xefbb8 |
0000c7453c1d69e32148890550ef1200 |
...E<.i.!H..P... |
| 0xefbc8 |
8b453c48833d5def120000741e48833d |
.E<H.=]....t.H.= |
| 0xefbd8 |
6bef120000741448833d31ef12000074 |
k....t.H.=1....t |
| 0xefbe8 |
0a48 |
.H |
| 0x14a0 |
62e8fe8a0800488b5d58488bd04c8bc3 |
b.....H.]XH..L.. |
| 0x14b0 |
41b940000000498bcde802a70f00e835 |
A.@...I........5 |
| 0x14c0 |
8d0800488bd04c8d434041b980000000 |
...H..L.C@A..... |
| 0x14d0 |
498b |
I. |
| 0x3510c |
00ba3a010000488d4c2420e8d4a50a00 |
..:...H.L$ ..... |
| 0x3511c |
41b840000000488d942470010000488b |
A.@...H..$p...H. |
| 0x3512c |
8c2460010000e8b570feffb801000000 |
.$`.....p....... |
| 0x3513c |
486b |
Hk |
Metadata
-
0x0
4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 58 d2 2d 72 1c b3 43 21 1c b3 43 21 1c b3 43 21 d4 c6 40 20 1d MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.-r..C!..C!..C!..@ .
×3
-
0x0
4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 58 d2 2d 72 1c b3 43 21 1c b3 43 21 1c b3 43 21 d4 c6 40 20 1d MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.-r..C!..C!..C!..@ .
×5
Identity
| SHA-256 |
fa608193e8f5c475f7120317f319eb77ea199ddb7d8ddef58b4580181d4b763b |
| Filename |
mystic_stealer.exe |
| Package |
fa608193e8f5c475f7120317f319eb77ea199ddb7d8ddef58b4580181d4b763b |
Origin
| Source |
harvest |
| Feed |
malwarebazaar |
| Ecosystem |
windows |
| Domain |
abuse.ch |
Timeline
| First seen |
23 Jul 2026 10:38 UTC |
| First analyzed |
23 Jul 2026 10:48 UTC |
| Last analyzed |
23 Jul 2026 12:37 UTC |
| Last updated |
23 Jul 2026 12:37 UTC |
Labeling
| Label |
bad |
| Label source |
harvest |
| Traits version |
2065e |