Extracted

• • Target
    PO SCO-20260407.js
  • Size 320KB
  • SHA256 47499fafe309fe64ca6707e1c1a2e59fb4be2446e4f1655cee8cfaef764ba439
  • MD5 32289521f7abe969aba9ad65c383b133
  • SHA1 4deee0fe91fe6c4a5eb19d1c4b6dcbba20725b56
  • SHA512 2e1e5e648397da79100ca023204a9cc0822270ec68b2480a6aa5728f29b4d9ef0ee13c2e067c0ccd189b58bd053790a7b02a3f0a98692f1fb44221fae8a72b09
  • SSDEEP 6144:raw5oWeeueVlwilpBBIk5rDp35F64G8KSkl45v0ulM85Ghy9:uPFed4ilmO5aVhl45n5Ghy9
  • TLSH
    T13064CF01EBFD500CF6F39F19E6FB1910096BBD565E1EC8EC04265C4D0A36A4889EAB77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencestealer

  • Detects PhantomStealer written in C#

  • PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Phantom_stealer family

    phantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2