Extracted

• • Target
    PO 4500272644 -R0-S - 254902/PO 4500272644 -R0-S - 254902.exe
  • Size 1.8MB
  • SHA256 332c63fac0deb1b5a81b3270e55a5cfdcc08dce46d31747f5346a1f3abb46979
  • MD5 10e4b4a4bc364295d93b5311b825288e
  • SHA1 4d94153111bc9b71c426710c44c04f28f937123b
  • SHA512 0736f6cc21882d979c33b399a6682e98cf59359d4f39d37aaf14daa1f3768833209b989b3f50db7196d2d50b14cb982b5034b76ddd7b67083f4aa01a2d00821c
  • SSDEEP 24576:fm/BXSQwFqEWr1AWZnFuif07+jV+CcI7FKESh0fQPiAQJldX7wOA7vKLeHfL:KB7wFqEWRznDf06ZcIRQ01JA7vx
  • TLSH
    T1249501927749DF11C44F12B2C4B2C2F823276E04DC0193DBB6CAFE6B78B62E96955583
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2