Extracted

• • Target
    MBL & HBL ADJKT2411000812 - BLJKT241180900.exe
  • Size 1.6MB
  • SHA256 e1420a9e6d6bd820cee7e88c9c50e67dd475d96df3069655426428a6d40dd18b
  • MD5 01f31ba800e33ba567d9a097dd530157
  • SHA1 8f41ac6b09fcbe9a34f480807c493d21d91dc30c
  • SHA512 c7084168e62fbaf4f2f526d667794d33d1c85826542c7926cd9d39f105964e4b275ff1e67529715579a24f590fae335dc47a738c910b7e7415083a41adee3f4b
  • SSDEEP 24576:QSLfgyXqe/ZbSMI5HNqw7fWxu2rT+IN6NCqo28ZfLOZJL:QSL4yXV4M0HNqtcW/NW8lmL
  • TLSH
    T19D75220D271EEE02D8811AB45C21E3B907744ECCE515C253AFF9FC8FB8B9695A8642D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2