Extracted

Extracted

• • Target
    Est PDA MV Global Harmony V-38A ETA 11th July 2026_pdf.exe
  • Size 1.4MB
  • SHA256 a1a64e53591cc747ca8a9b906bc83ea3d6394aba5fa6a0d7a4a4acc725407a5e
  • MD5 1348b61498226312efc6de0c4b30bee6
  • SHA1 c7a3c9f19bee1dcb92f7db25dda92a00ba73e226
  • SHA512 d4776d05b96073cbea3b2bbcda19f21fe00b887827587747f0daa9e70474e2f44d520e0e3fcb723ed13efff51914dfa7489b086896e427476619701c73cab206
  • SSDEEP 24576:JIFzrn0Az7LHPmMWsj8HmfDtO8pDhArGorxZnOkcPZaIF6lP5CZMX+vTKnCPTsBo:JIFzrn0SPmMxBOIdArRZOkUa9152TNbv
  • TLSH
    T16765231D6348C167D0572F391E32F9B407768CDD4912D24A9FF9ADB73836BA22E007A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2