Extracted

• • Target
    PaymentAdviseSwift0285.bat
  • Size 260KB
  • SHA256 12db648c3d516bb4210f37388077273757ea792168a6c32a9c0210cbfc7c01f9
  • MD5 c0214c5ac40753c905e4ecf9c4a8b48e
  • SHA1 8cbb0796cce9e55c5ad359ec5a9628a06908d627
  • SHA512 c0a4871de1c06b72d86a8eb51e5d6cd5f7daff21e1c4e16f20e866625f7b9ae2a2e6157ac5025817c7a0a6ee100aa9de7c09e4f0239b9c940e577db116b7133e
  • SSDEEP 6144:kcBvWb00fuvQJqjJ0VCbUG2wdSU8kjVHHT:tO0ouYJqjJSCbUdwdDjx
  • TLSH
    T1D344121876E4D4A3C13102700F7A437B5BF25B240AF54B5B3B60EFAD7843A919E27A67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderguloaderphantom_stealerinstallerpersistencespywarestealer

  • Detects PhantomStealer payload

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
  • MD5 12b140583e3273ee1f65016becea58c4
  • SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
  • SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
  • SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
  • TLSH
    T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 b2699fdfdab6a018fcc972806d12f71972de1861660bb6578935d62b1da06504
  • MD5 3cea4c9994912d8f3c3e8b6a814e810e
  • SHA1 c48d34a0981d4ab576c7a3ab566f5ddb94af5d86
  • SHA512 d317449f3c3115e279cff148c3e0bccc9b1d4ba82d1f85c0b99d7db657e85f752c0691d33f8024ada5850c993d0bdcbcc70b296b7cf33d7d14a67bc16ca3b4a3
  • SSDEEP 96:o417lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx4Lb8qndYv0PLE:oOl7wrLBn0REc0JxEdO0PLE
  • TLSH
    T1D51207135A0444B3D9E2223A31AA2F2ED73C9324D0A27D02C777DE5A2BB43166D3E351
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6