Extracted

Extracted

• • Target
    1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af.exe
  • Size 840KB
  • SHA256 1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af
  • MD5 31a70b06d091ce9670daad3f038afa5d
  • SHA1 ae8a853f7a4dce451a97028b4148af01d3b586ca
  • SHA512 deab07bd4cb566af64faf96289b1ae93dbc3dedec81b75f5fba30607afd6bc8fb21649d04391d4a2fe4c37663837c037a9f95712aad35f10b2bdc878425f4670
  • SSDEEP 12288:4goCnolCsoYdAA9mJadBeFZYBpqEC1xv0oi7QgYzclg8eGiMahkrwK:4lfMs1hsAdBen2pqpQwclgbtK
  • TLSH
    T12A05DF0813E88658F8BDAB34913736154BF0B40AD936EF9FA3C464BD1836B94D697723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryphantom_stealerxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Detects PhantomStealer payload

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2