Extracted

Extracted

• • Target
    NOTIS PERINGATAN BERKAITAN KEGAGALAN MEMBAYAR KESELURUHAN CUKAI TERMASUK PENALTI DI BAWAH AKTA CUKAI PERKHIDMATAN 2018.js
  • Size 42KB
  • SHA256 abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749
  • MD5 ca465e8a45332df121ce3b670bb3d414
  • SHA1 e0485c03d3570701b3449d487450b8b117d13ecb
  • SHA512 e50fb9a43b3c39afadd132770724d823e90c7d94525227bc81be8e89d947635ea6db83a023bccade0579b7c24ea533dd4466f4234e621e7da51bcf021c0fa482
  • SSDEEP 768:t/ibV9ATKPTkeZ0Aryg3dqwBUVKeaHKZpZ38wGd8p:librgKPTk+fr5lBUqHKZpZsJY
  • TLSH
    T1B313868D3EC3A0924352D07F3E2BF5D9F1AE0CC5765880C9F675B44AF8A8B18D936658
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionadwarecollectiondiscoveryphantom_stealerpersistenceransomwarespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2