Extracted

• • Target
    rPedidodeCota__.bat
  • Size 4KB
  • SHA256 7db5c8635d448b2f18c06d4b664f44731015db2fdec80367fcaef8f22fc2d3c8
  • MD5 d4196a9c72ed551172e24cc716bb5b69
  • SHA1 f2d04d2e55ad44528eac959891525771741a3e34
  • SHA512 9e3b810417b52b3801b3df791bc61231f230070c01cd31728a9c28140e04de8d6000242e146e7ddcd438d2fe3cb1ebc03a2a38321a0f5413cbba73ba6fc5888b
  • SSDEEP 96:qQNWOGVtsN2owx7gHzmepIrbcmoJnL01cLXGMGM:VYZKIrqJnLraM
  • TLSH
    T1E991C7639E27C5F50EA25A353A0800532CA38BAAF852153ABD9882ED2C5405C52FCF79
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerstealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2