phantomstealer | 4128dbaf0fc2b0525254992db51b68bef25796c919f8390ea4e9336e4477a2a7

Sharing

Copy URL Twitter E-mail

General

Target
4128dbaf0fc2b0525254992db51b68bef25796c919f8390ea4e9336e4477a2a7
Size 3.1MB
Sample251030-xyydcack8z
SHA256 4128dbaf0fc2b0525254992db51b68bef25796c919f8390ea4e9336e4477a2a7
MD5 3b94b8e3a8d04e2cbf1a0bf529b4d0ab
SHA1 1a93705fc10c67e79dd5a63ec9565bde010dfdc0
SHA512 78934b9b02a04ad6a7122e42612b99db13925c3659487eeaaf12b0d84d1fc5fd8c69556a7d47149f523711b7e246d832c7e160dd20eeef8dbfb996e228396a56
SSDEEP 49152:8KsAiy5CE9ArcceIpoWKCHHl6Q+Uz/TB18kNkDC0p9KkkJmcklopu//lC16L9XJd:NPudL7KCobUTNuHo8cklSYa6L9XRLbh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z

Extracted

Family

phantomstealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z
Email to
[email protected]

Mutex

12YHANZ1JWN7VAAFXR6S

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Targets

- Target
  .Purchase Order- PO-229818-10-2025-MK2310-APRG-937-PROC-PO 1787-25-0O8320 Project Order.exe
- Size 184KB
- SHA256 5376b0fea8d666fdcc1f330bd6f34aa5623dcbcad4b0ffed53087456ee849214
- MD5 8d8309a795cb4b5c7e66bf202d111037
- SHA1 5b3c7143d89938948f1df45f64d08d64b1e5177b
- SHA512 8d38e2c0efbde236fb23ed56a9e024e9723ad8dc6f02b553f11bf1e2eb70d6ea32fbcebd8812230a1abeccdccb84fb6c46ca811f7f7d7cc149d342af439140ca
- SSDEEP 3072:pEqn/irEsrD3xo2vYsWwY6JOXnVvqAKesWu4OauYfI92YETrc3M7:l/irEgNWoJOXnVvqAKesQOauYfa2YETt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection discovery phantomstealer persistence
- Phantomstealer family
  phantomstealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  MSVCP140.dll
- Size 5.7MB
- SHA256 363022bd7bf8deb61785a3ec95d107893370f329ae2460effc5a1addd100995d
- MD5 64837a9c4b7165f305ea9b6d1554a68e
- SHA1 2cb5e9901bc76ecbd303c765e035f228e3e0b291
- SHA512 f92bd14c9798c27138f9a07eceb8099101d209dd5e281cbdf7b45809cb8d324c1f0206195950cebee86c4542c545a29bb4f0418670fdf10abc1fb0a6f763086c
- SSDEEP 49152:BlClpF9AqFx3mqO0+rjJEipVb/sC6aF/Sad0H7/UAeVCux70BEsHIMY3LkYP2GuS:rqOrpV7Fld0bSaKMkP8BR3WKc
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection discovery phantomstealer persistence
- Phantomstealer family
  phantomstealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  VCRUNTIME140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  VCRUNTIME140_1.dll
- Size 48KB
- SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
- MD5 cd1b08f4930b276ad78853580b76b5c6
- SHA1 a0330279d3d0d47f19ed984726e25260b547a228
- SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
- SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  concrt140e.dll
- Size 735KB
- SHA256 661412c324e935bbbbde27105ea706e55485a527b565fc55a9b43880cbe5885a
- MD5 8d1c5478ff8da98b10bf4f66da33220d
- SHA1 5236174d24c7309a3eecd9cd76375d2bd93cfbb0
- SHA512 3bcf38c9f86bbc40c487f7e8c833d1b390573e8e8751732468fee57cd31e74b4271ddbbb5429f513677fd651a5bac1d72f44db2b8373556596fb8a4bcda670d6
- SSDEEP 12288:PXt2CdJI5hqMNk97b9Gu3hK7kZOLhrwJVckSG6ZCoLONH523u/kaIvVmQPNOOK:PpK0AG9GTkwLufcXG6ZMT/VI9Ps
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Phantomstealer family

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Phantomstealer family

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10