Extracted

• • Target
    PI #65277_SOA 2025-11-11.js
  • Size 2.3MB
  • SHA256 b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7
  • MD5 a88fcaa7d23546267052d4693631f8ad
  • SHA1 f21eb08a59ebd847f76799e8d326d15d2b3f18ea
  • SHA512 a39868583b1d551a4fa143fa9ce80d6a6802235b3b59dd52bea8062df3107d1813271277ceb905014996c7768c632dfcb4004b2033525faf05e64727fe643c3d
  • SSDEEP 768:kgBXa/tG0pW441b4Z2e0phOfHe+y9vxv3t7WflsmPfTWpevnDOm7rBT6bDOGscbZ:dZapWfbZ+yVjErWpw7rBT6XlF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionphantomvailoader

  • Detects PhantomVAI loader aka VMDetectLoader, CaminhoLoader

  • PhantomVAI, VMDetectLoader, CaminhoLoader

    PhantomVAI, aka VMDetectLoader, CaminhoLoader, is a loader delivering a wide variety of infostealers.

    loaderphantomvai

  • Phantomvai family

    phantomvai

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2