Extracted

• • Target
    FACTURA.js
  • Size 2.2MB
  • SHA256 235a078447b8d67176bee9b3b3d009f52dfe9f85dbe76434fd3ae7f438795604
  • MD5 1765c73b5518c5f13360d7e25e27405d
  • SHA1 d21fb527713375168b5f405edbc7de2bb9dd58ac
  • SHA512 7debde314b483687dab82e64b0da1ba75ec355aa13b2390660188bd27add25be9e0196a17427676f15010e5e5405eb5ac594c46c76cd22cdaebb83ac1f4c7d11
  • SSDEEP 768:1wbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbwbX:dS
  • TLSH
    T141B5574E9ABDB353FD9424F4E849D109E46724B3674242EFEA4EC5CA70E1C74C8F1A26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistenceprivilege_escalationstealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2