Extracted

• • Target
    Factura.PDF.js
  • Size 65KB
  • SHA256 b31a02caad591b90d832673d25c533524d1a3a73a4d3208abce82fe74ff22997
  • MD5 21a1309d493edafc14d16cfae2858659
  • SHA1 ac01d136917bb81a26572f42bafc7f95aaee09d0
  • SHA512 98f191803c748f5157d17f2200d13dbec3ea53ee7114262baeadfa127c3a6f5f4a8624c596c520132555c1806404272546e29ee520a9ffad398c3885d6e1aa78
  • SSDEEP 768:hC71U80/mdqV61bt0INWELnqKId7TJh1TAsSRPkr1ruFzYW/+AQbCi8VSrhqWS4X:6y1hQa
  • TLSH
    T1366325E925CF8C0CBD6BDB02F316275CC9E674930B303636A6671688EFF794A6A14474
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2