Extracted

• • Target
    DOCUMENTS.JS.js
  • Size 6.2MB
  • SHA256 c612385efecaca9ec7446fdc629d871a12fbcfca9ed45c653faf20361d3105c5
  • MD5 f6bd5fdbc0205d413b60c477b64ef877
  • SHA1 328681b0c8f54c3cc693a211e2fe09b232b27d74
  • SHA512 44f5ab0ed2eada3b8a9ee694313684a26dbd8ec0ab4f2547de16bc62c42aec063ce1f1b78378ddb68a657c363cff6805cc41be0f61f4c319977759977b97a305
  • SSDEEP 196608:/4W5Fr43V9Hz2E5s2g8GT83GhlUFRKqcwREsvkA3BoeSY6vnDZHucL5rNF:/4Wc36UBm8xkrwXvkA3BfS/f1H35hF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencestealer

  • Detects PhantomStealer payload

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2