Extracted

• • Target
    Payment Copy.vbs
  • Size 2.8MB
  • SHA256 eee1cb0b93fb73dd6cee64929fa767367650d2f08894b6c713fd2874607eb15a
  • MD5 c54a91582c2022485e33709d0720795a
  • SHA1 262e22f17c27774eaff315b18d691faf95dd3629
  • SHA512 ef826da99d5c3c62e752d3e9f0c6e9a59cdff09fb3080b2f1140127f99ef85e61124f07b916ac7aacdcaed44327691d6b0b0959a6d31502fb2fc0088c31e19d4
  • SSDEEP 768:7F9vfDNp07S8xq3vw++1nkCeXvWuLmRZ6hpTECqNn639rnfukzfaSvsV/2uuatwy:+
  • TLSH
    T185D59774006227F8CFC28257A8ABDB43B4EF9F67D617056B108A6546451EA1C8EE3FF1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerstealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2