Extracted

• • Target
    b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
  • Size 1.2MB
  • SHA256 b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c
  • MD5 c714eda54303d9235a46ce4537efc074
  • SHA1 17b5a790e2250b4e7a12ae2c0b35cc56103f0910
  • SHA512 4d7191bddb61ac099b7e19e65287c51952e52aee4b34d1420d6ddda0d44bcbb5caf63191736512c9e97074b603704bfb2a1d054cbadc679f6a4afe42bc791a7b
  • SSDEEP 24576:XL21q+uS0KBjzt2a1IzFVgZB31PLNqw2Tak+RECk59vIzy2kNRcL:ahuTMv31KXgnFP5eTak+mNjv8y2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer payload

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2