Extracted

Extracted

• • Target
    Fiyat Teklifi Talebi Rfq083891_Tekstil Madencilik Ticaret ve Sanayi Anonim Şirketi.exe
  • Size 23KB
  • SHA256 99c04e506e0bfa4ca0bbd3aa52020a7274c036769e95fa34573eb24e88530313
  • MD5 67fc8ad42d5a539471a6070dda1e4828
  • SHA1 bceeab3e2a5a89f7f1b7bf9770c5f528e855acf7
  • SHA512 a25123eab0bb16317e9ddd9604e5de8296a947b277c0216e206ce060d8b16d11727e3f286271bf69e7b73f4364b5b56a4d3d85def1175d45f133e35df7aab3b6
  • SSDEEP 384:vz57Ngy0RmSJ4b1Pk5YS0CKmos0VzN7GOqHymZh7/ac5UqoQE4vaG5LCMThNH4qt:vz57Ngy0RbKbF7S0U/0VBDUH+qoYv4sy
  • TLSH
    T17BB2953DC6E5ACC0C7AF12F074AFBBC502AAE717BD2B4B6CB4C814461E60654AB74748
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executioncollectiondiscoveryphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2