Extracted

• • Target
    2dd2f82bc17ed44113d07f5a64fe5a6b2a7caeb856a5619e6123962a9746f1fb.exe
  • Size 790KB
  • SHA256 2dd2f82bc17ed44113d07f5a64fe5a6b2a7caeb856a5619e6123962a9746f1fb
  • MD5 4557a26dd51c27e8b74d89808daba658
  • SHA1 0857dc1c42e3ddaee6516731b062d26da6df051f
  • SHA512 7389a6353bbb7909b99a10756938516c234d06097ca83eb612260eacab306a665434870f3cec75c89783ae46f24adae420013a32fa7ddefe6c3527f7f8f995b1
  • SSDEEP 12288:fqNbHfa6KFGpBQgYgoraBbKaO58TN9lhz2eHXK6d8/LE42MF6mmKya:ebHC6KgpK4owKaO5i9b2kqLE4OKya
  • TLSH
    T1D405F10F71A8C4AECAF92EB1F8265CF44A4D5C159D98404EB7C973CEA6F22F5531A10B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryphantom_stealerinstallerpersistencespywarestealer

  • Detects PhantomStealer payload

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
  • MD5 81e268e27dbbcadbf116b5a9402195ab
  • SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
  • SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
  • SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
  • TLSH
    T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 7853be9190489ba84dae8232e9a967cec02d941732cb4137bc9ae6a392e89fb8
  • MD5 3fbd78c889fa40a2e5567b980c57b7db
  • SHA1 303564bfa6fd5ab7a65d35ae1cd14a05643b6b5d
  • SHA512 95ccd599cdacb1128aa35694aa5428f12f50a20d95bb500e9b180b3ab322b1870ae301f77f7ca0e8674c78742a1eb5c82ba3cee05c67d3d961a695563c8c1514
  • SSDEEP 96:oX7lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx418qndYv0PLE:oXl7wrLBn0REc0JxedO0PLE
  • TLSH
    T1371207135A0044B3D9E2223A31AA2F2ED73C932490527D02C777DE5A2BB43166D3E351
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6