Extracted

Extracted

• • Target
    PO-000296.js
  • Size 4.4MB
  • SHA256 f50806bf6a0c94a886d1650f709079a7199bc6a1b0cb16fd3fe6aa093293d014
  • MD5 a23729d1871039f21c6b991ca177cccc
  • SHA1 a80def96029097574d2e9aead1ae0902f79d3c9b
  • SHA512 19a30df40c77a9862ccda6a9227bd1a688ec7087bcfd706101e416d0876493614aef551c015c7d0b281fd1f17852b9eacd66d2c14c7122a3860d1b8dfc50b5fc
  • SSDEEP 49152:PzpE7FjxLgXl4+dq1nYVJqwcCt2b3Oot87D/wwRe8:1
  • TLSH
    T14626021589C42FB5CFAC5A1C50FE161EE3F04A8A5466798AFB33BD46EFF7604421B188
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencestealeradwareransomwarespyware

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2