Home > List all groups > List all tools > List all groups using tool Cyst Downloader

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: Cyst Downloader

NamesCyst Downloader
Description(Proofpoint) In at least in one case we observed an MWI document install a previously unknown malware (SHA256: af17a3b5bf4c78283b2ee338ac6d457b9f3e7b7187c7e9d8651452b78574b3d3). We are calling it the Cyst Downloader. The functionality of this loader is limited. It can create a mutex such as “syst<10 digits>” and communicate with the the C&C server to receive a DLL plugin. The URI path pattern of the C&C beacon contains a folder (random alphanumeric name) followed by a file (random alphanumeric name) with a .jpg, .php, .gif, or .png extension. The downloaded DLL is encrypted with a hardcoded '\x28\xBF\x0A\xBE\x5B\x6E\x70\x03' RC4 key and base64 encoded. The server sends the DLL in HTML comments in a fake 404 response.

Last change to this tool card: 19 April 2020

Download this tool card in JSON format

Previous: CyberGate RAT
Next: Dacls RAT

All groups using tool Cyst Downloader


APT groups

 Cobalt GroupRussia2016-Oct 2019X

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
PGP Download PGP key