Extracted

• • Target
    _095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095.txt
  • Size 1013KB
  • SHA256 095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095
  • MD5 01d50097956726966151f342e7b55471
  • SHA1 2742082bde0127e0427612cd63bc48c5563b8a82
  • SHA512 66463470ed571554c8ab616b0fca82fb2b80d617537884d92a12e4295dca53f17568ef0ce2be68c429ffaec0bc383eb3ec19acb6b822fc98795d846e12126f10
  • SSDEEP 6144:CfYcJfYF6f+fYR2226fYA2222222226l226fB226fYcB22222226fYO226fY+22B:qgPF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  adwarediscoveryexecutionphantomstealerpersistencespywarecollection

  • Phantomstealer family

    phantomstealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2