Extracted

Extracted

• • Target
    OAAAA.vbs
  • Size 5.7MB
  • SHA256 decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392
  • MD5 a707e79e2eebffb298ed7aad729c8e29
  • SHA1 6d9367c6a7ed64992996412f59fd09b273334578
  • SHA512 c0d04cdb952a778a64587b0eefacc5931a5ddedd93685d25dcf9c60a5d2885def832f42e00032aec6c604ac0910088d5ef1de27b139c048531a7e29e4dcfd6e8
  • SSDEEP 192:Mr1GAbEdURa6M2FVEdLDG6VeNzFw0ZD164999APl/9Z6Qm6bON+Swmmmmmmmmmmi:AVEgFjE5Vw4yyFmmmmmmmmmmmmmLEo9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionphantomstealerpersistence

  • Phantomstealer family

    phantomstealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2