Extracted

Extracted

• • Target
    Construcciones CAMSA S.L REQ2060026.bat
  • Size 3KB
  • SHA256 7c161d7478660f3ef1fe7a6ecb9bcc4d45d2c505b2febb544c1a4bd84e0974a8
  • MD5 4d8271ef3a1b720745cfff26f7fd1115
  • SHA1 10a1ac2bc4cb7fa3dda1a56256154ee3b436ef69
  • SHA512 a0a92789f0fd9c864e062f330a1f5297fa6bc0c499655dd5cb5d237c4d1694c1ac9dcaa02d694de60e8ab466d851fd243893220029286142de02ecca6fd4691b
  • TLSH
    T12781D5D25707617E113859733B8FC029A822211904A29A0FFFD8D21CD2B76D70F8B6CB
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerstealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2