Extracted

• • Target
    db4ba887fbffce0421ef201fd572c3ce93e4d6ecdbd1c13e2707d1d02b2c4f65.bin
  • Size 946KB
  • SHA256 db4ba887fbffce0421ef201fd572c3ce93e4d6ecdbd1c13e2707d1d02b2c4f65
  • MD5 b8007a999021f8e74cb1bc632cbd4581
  • SHA1 5521db88381a9e9e338abaea160a5d05eaca7eac
  • SHA512 6ddfaa028829667c3084e2a6b55c8cc2301071916d04818753b97f2fb807c85194eb0eb1fd43d9f041feff7e0f37efac962f421ed51877a5d66b3c4cb526c791
  • SSDEEP 12288:qHxtWienWSpd0OqqNwdbuC8NRx0ZVPCT/almpRUNiElurCq0U09Acagmkf/3mdQT:q2n5xNpPiZVPm/aw3OrU09AAL2Q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectionexecutionphantom_stealerpersistencestealer

  • Detects PhantomStealer payload

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2