Extracted

• • Target
    new order.bat.exe
  • Size 484KB
  • SHA256 ea8c94c322bfcb950b6ed1e672819b930feff110eb33ff0bb8d00a8977757e3e
  • MD5 4eaf0516cbf78a31a9bbe63abf3688df
  • SHA1 18f98a57f49930dd84341a1d5babeb10aa5509ea
  • SHA512 1c6e74994b142b4e7bbc29221ffd96ae6d1b6156fa8424602ffda80610575c1363df0c529e6600cbbd1468c550a93ba2d7aaed789f319694de59c80b7839fa15
  • SSDEEP 12288:XcODb7v0o8JvG5UFP+ibiucOTjjjjcjzjcjcjjYXxyFCsUO5KC4jAqVjMyYS+s:sO4njjjjcjzjcjcjjgxyoscjIns
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryphantom_stealerinstallerpersistencespywarestealer

  • Detects PhantomStealer payload

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
  • MD5 34442e1e0c2870341df55e1b7b3cccdc
  • SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
  • SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
  • SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    Klargjortes60.deb
  • Size 42KB
  • SHA256 b2100ecfaa58ac375fcd710cd489534c20f00e790ee88d10e08583fa25c5bc61
  • MD5 497e38fedc6c427fdae869c0fd3f4d8e
  • SHA1 e40c73baa31af598e34d346ab8d26123a119ad59
  • SHA512 df20e0db1c9dc818d819a764633267b3c1840724e0752fbccdca861085f96eddea2911d4e8fc967a52f0d4788878f565d96189281b52cfbc5d06f3bfd0c86bdd
  • SSDEEP 96:Qwix8axk9DfJnikhM2bjwurdv3B5mwZ/csupi5BgbwJ6Z:vix8axk9DBndhtXTdvRFZ/csucBOwJ6Z
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral5behavioral6
• • Target
    Naggly/demaskeringernes.app
  • Size 7KB
  • SHA256 967c433e68bb8c147b9df436571910da135e6393749a2e2664b367b1acf0d995
  • MD5 1d797bebb156d34364742a974a5843e9
  • SHA1 24956a5801dfd849504297b6df63d7909906838c
  • SHA512 0941a714031a43428d77e5f97126f1db86955f59093a506e6fd1dd95c47480f7c0f69d50576f0901bec531fb86cbceace3a9f8667d0872ab8095643303c34e71
  • SSDEEP 12:PXPMvVht1TXV4fzR8NUJoX3roW4+TjXmfXfhxXdoAfjRjUk613:/KVJWr2GI3zmPpBdK3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7