Extracted

• • Target
    4690fe7dd78cf815ea311d64d6503a5fe8b32865ca8e4e74a1d1e1bd2f384a7f.exe
  • Size 1.5MB
  • SHA256 4690fe7dd78cf815ea311d64d6503a5fe8b32865ca8e4e74a1d1e1bd2f384a7f
  • MD5 55a22d53788ba29a6328f112758841f5
  • SHA1 4cfaba917d4611f38b3826bd13c1821b687894ce
  • SHA512 db8cc64186e623412e79f4ed9f3562efacf22edfdde50528e7b4737144bbca629de629c3d4daf99c71d0f031e8a0ae97dc949073ccac6c7dcde0aefb4a6aed89
  • SSDEEP 24576:s/GKMZDknqnUms4PWVlka9YHHsfddDATuHidNM9ipRSBlyjbp6fpEvdpwH3EbdbW:s/bnG+lP9YAdWTuHiopBlyjbtwH3idbW
  • TLSH
    T10865231833C6DE13D8E54A755A71F23027B92EDC605AD21B8EE6BCD7B93A3D00C81697
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryphantom_stealerpersistenceprivilege_escalationspywarestealer

  • Detects PhantomStealer written in C#

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2