Extracted

• • Target
    QUOTATION-20260424_Price_Request_DX-DXVALVES.COM.exe
  • Size 842KB
  • SHA256 22e20c87b8a58256ba2d789c04fa52c109cd991dd82f270e4c4da5b72f057b77
  • MD5 937c0a09cb717d775df9c50633a2b016
  • SHA1 af3a35ab5dc1813652743495a29d2d23a1e4062f
  • SHA512 be18fcf5fe71d6187548d62b26f8f769e535739611c22f593b91249e6684ce966c8da6f0a0b37ec5e3151a6f6fb59d5f29fa0118198c7b867b60dedffbdf7ae0
  • SSDEEP 12288:s4YMuM9GUK1dpwyT8PqPN6GOYF8n+oEr4ObwIxFIB/VcT02NWwYGMLIKi6L/2+Dt:sDdgFkdprgPFz+82xFIBiFtYVL9tDI
  • TLSH
    T14505124A73D41B04C95A65F8D5E3463903F25AC732B6E3A43A940AE71E823F49CDA7CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryphantom_stealerxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2