Extracted

Extracted

• • Target
    Payment receipt 2.bat.exe
  • Size 269KB
  • SHA256 2babb5268496a4b5231d8d58e3f84ebe220ab2ddea277ec9910bdbdffb572f4d
  • MD5 3238874df93198525df1c1a03cc4b75e
  • SHA1 498b7141a37239f11edcb5f477a5c62f2dc167b8
  • SHA512 f540de49269648bc853025ea0b19bdf672a1a9e68eff8fecf7eeb7929080802fc7d189777484e1dc72101c6e17032b5da3b007a930d120f9782fd4c3282af993
  • SSDEEP 6144:kcBvWb0Pv8SNUzKRdCb1J49OYTczmB/doLcPCkT:tO0PESSK6xJQJTnxifkT
  • TLSH
    T1394412A5B270D4F3D2735BF09E731A779BB9EF14129146833B45BB2E7C37A408A4A502
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryphantom_stealerinstallerpersistencespywarestealer

  • Detects PhantomStealer payload

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
  • MD5 12b140583e3273ee1f65016becea58c4
  • SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
  • SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
  • SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
  • TLSH
    T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 b2699fdfdab6a018fcc972806d12f71972de1861660bb6578935d62b1da06504
  • MD5 3cea4c9994912d8f3c3e8b6a814e810e
  • SHA1 c48d34a0981d4ab576c7a3ab566f5ddb94af5d86
  • SHA512 d317449f3c3115e279cff148c3e0bccc9b1d4ba82d1f85c0b99d7db657e85f752c0691d33f8024ada5850c993d0bdcbcc70b296b7cf33d7d14a67bc16ca3b4a3
  • SSDEEP 96:o417lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx4Lb8qndYv0PLE:oOl7wrLBn0REc0JxEdO0PLE
  • TLSH
    T1D51207135A0444B3D9E2223A31AA2F2ED73C9324D0A27D02C777DE5A2BB43166D3E351
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6