Overview

overview

3

Static

static

1

Phantoms F...an.vbs

windows10-2004-x64

1

Phantoms F...an.vbs

windows11-21h2-x64

1

Phantoms F...All.js

windows10-2004-x64

3

Phantoms F...All.js

windows11-21h2-x64

3

Phantoms F...mps.js

windows10-2004-x64

3

Phantoms F...mps.js

windows11-21h2-x64

3

Phantoms F...veM.js

windows10-2004-x64

3

Phantoms F...veM.js

windows11-21h2-x64

3

Phantoms F...ces.js

windows10-2004-x64

3

Phantoms F...ces.js

windows11-21h2-x64

3

Phantoms F...ces.js

windows10-2004-x64

3

Phantoms F...ces.js

windows11-21h2-x64

3

Phantoms F...tra.js

windows10-2004-x64

3

Phantoms F...tra.js

windows11-21h2-x64

3

Phantoms F...ra.vbs

windows10-2004-x64

1

Phantoms F...ra.vbs

windows11-21h2-x64

1

Phantoms F...rm1.js

windows10-2004-x64

3

Phantoms F...rm1.js

windows11-21h2-x64

3

Phantoms F...m1.vbs

windows10-2004-x64

1

Phantoms F...m1.vbs

windows11-21h2-x64

1

Phantoms F...er.vbs

windows10-2004-x64

1

Phantoms F...er.vbs

windows11-21h2-x64

1

Phantoms F...es.vbs

windows10-2004-x64

1

Phantoms F...es.vbs

windows11-21h2-x64

1

Analysis

  • max time kernel
    93s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 04:26 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Phantoms Free Cleaner SOURCE/BetterCleaner/CleanFiveM.js

  • Size

    3KB

  • MD5

    a3319de8e72c427d0374c2a6455855c9

  • SHA1

    2e975350ec9b0a6fe5f4f02158080a0c6877a9ac

  • SHA256

    4bca763bc0f007c832817ca9254a0befea9d8ebcadb1a7d7aae4e470c4f49bfc

  • SHA512

    977c0e0841f1a3945fbe9d691a6dbba1627830451ec2b24f51a6afef7fa0fd320a318f87af6cc80c64cdd9ff28da8a4bb94f5d595410bb3e674e3b45e3d59d0a

Score
3/10
execution

Malware Config

Signatures

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Phantoms Free Cleaner SOURCE\BetterCleaner\CleanFiveM.js"
    1⤵
      PID:2908

    Network

    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      80.90.14.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      80.90.14.23.in-addr.arpa
      IN PTR
      Response
      80.90.14.23.in-addr.arpa
      IN PTR
      a23-14-90-80deploystaticakamaitechnologiescom
    • flag-us
      DNS
      14.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.227.111.52.in-addr.arpa
      IN PTR
      Response
    • 52.111.227.11:443
      322 B
       7
    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      80.90.14.23.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      80.90.14.23.in-addr.arpa

    • 8.8.8.8:53
      14.160.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      14.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      14.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      14.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.