Extracted

• • Target
    e-dekont.pdf.exe
  • Size 1.2MB
  • SHA256 dc60b3a787e014b5ed9ef2a3eb0d7b7d93ed800d0524a10d0eb8447d47b43926
  • MD5 6f5ae138326ff745f4a8d7d3621e7673
  • SHA1 459d6d57c8b3c07fd778c267a8ac8927d2b7839e
  • SHA512 0d79f81af365f9e76fe71873456a65d1181a17a6ec6278d933723f9dba3fb2592ec219b13367b0efbaf6244a30374d82703e5adc6c5eadc1c3baae1bb21fc1f5
  • SSDEEP 24576:+TnypdJ51YxkIJB4K1hgyc6LQ6sJV6+5yKI9rdJ8o1ZyAw7kJ9oS+v62f:ugdz1xwLBAk9Pjj5wq9oSs7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionphantomstealerpersistencespywarestealer

  • Phantomstealer family

    phantomstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2