Extracted

Extracted

• • Target
    Pedido de Cotação-20260602_Mapa de Quantidades_Lista Comercial_pdf.bat
  • Size 3KB
  • SHA256 75eed202501778b0e5e4fcabed514a7f8fa1ff03a058e040c0bee919b2d27def
  • MD5 47d3ca8b2279f5eea38c22cec63e9df2
  • SHA1 2a0d9331c7365339c143d84ad184eb5a6fb28c68
  • SHA512 08d2254b262980751597d5708546b19982e0c531defb6d99d8c139b66483d7f2ccb24f3fbcb2fc42748026209df08c2a08079bf25a4f66ab255188bfbd547be2
  • TLSH
    T1D981F802BAA9760A97A710E4DA8E75203E2E9F1B92801796C5EEC34C21C511636FDDE9
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  collectiondiscoverydownloaderexecutionguloaderphantom_stealerpersistencestealer

  • Detects PhantomStealer written in C#

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2