Extracted

• • Target
    e-dekont.pdf.exe
  • Size 1.2MB
  • SHA256 6945230e786da1f48c3f4d9ea9fa52a73a501d343c24cc3616ad4e092b32fb5c
  • MD5 4c7ac9b03eeb8e4ca1070b386aeaf43e
  • SHA1 0cc8c73ea802690126b66dc42f5fcf18458ce380
  • SHA512 1601af238b753d3883a501962085205415672f9a70f257dab9db5de9b2fabfdac6ab0dcb01accd4ed12a4b46c5c6762c381c3097898f26d8c30ace4eaba1d8d2
  • SSDEEP 24576:+DAFLQAAxHn0Ui+KH6nWyuyapu8SJLUeqlMVNpxVrmkD7XV2vB:+GpAJnC+XapuzJL7eKpx4WkvB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionphantomstealerpersistencespywarestealer

  • Phantomstealer family

    phantomstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2