Extracted

• • Target
    fa4a8617c2f42af34d02ae881916a128ac30549f3c848fb4e72d37c8ee55aeb1.bin
  • Size 956KB
  • SHA256 fa4a8617c2f42af34d02ae881916a128ac30549f3c848fb4e72d37c8ee55aeb1
  • MD5 ccc08545c31f06b834dbc00eb54b5802
  • SHA1 164dc75e89e20ce36a092e120207e485bfdf3087
  • SHA512 ea24a0de73abd26d387d962354edd872d1f299fcaf184180d55e4769ff5db9342e02d610549f5a5b692895a92bab1b84cee258d2cd7c5f5cc96ad3336b266a45
  • SSDEEP 12288:/lQjr0mt8dgGlxocnEknJRFIpQ4nnmyHjLuSLPQXQAplfJTfTvOj2yqS:/y3Jt8yQDFrFI8ynuScQAD56jJr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectionexecutionphantom_stealerpersistencestealer

  • Detects PhantomStealer payload

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2