Extracted

• • Target
    OFFERTA A874 - RIF. MAN2625_TECNOPOOL_ PDF.bat
  • Size 3KB
  • SHA256 2bd259e64edf8204a563aed1ca9ca2fa0b556f528c4892c0ab1fa75753c91376
  • MD5 d6d02fb9aee590db4e85a5f640064f6b
  • SHA1 fd407984d29303e94de26101fc24c9d45f91f7fe
  • SHA512 8ae59a2ad4bb84cff9e1cc4bc8e31cba7a903cc032f9b70f2e445a3036d4403a594ac86fff017957a82d7f7968837ad1aca96512de533b0293ce8793f4626d9e
  • TLSH
    T1E581F604E659C9CA30733CB26DC39A2ACF798D9E0C61C4A7C9483028C48E45BD7EF666
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutioncollectionphantom_stealerpersistencestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2