Extracted

• • Target
    9929f1d675a2190594aef5ec37ab22af416879539d8ffb5c80194d2d3e8edcc3.exe
  • Size 2.2MB
  • SHA256 9929f1d675a2190594aef5ec37ab22af416879539d8ffb5c80194d2d3e8edcc3
  • MD5 aa245b6006ef6e24763ed2fbb598834a
  • SHA1 5408ca6b0659ec7faa7cf506f1f5ed57a748e373
  • SHA512 9ccb678ad145297d1800f0b7b18907d8a5b7f30fc32ed757458a3b4515f78addb4357c96316f579395a2ee400b3f3d2f65a634c445b9b671cf3e4823cc4beac9
  • SSDEEP 49152:oPVtuLZeJbInQRaht1d9epupiXc9jcDmg27RnWGj:2sYbInQA7opupiXc9jcD527BWG
  • TLSH
    T132A5F1027381C062FFAB95334B96F6155ABD7D260123A62F13981DB9FE701B1463E7A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncosturadiscoveryphantom_stealerpackerstealeradwarepersistenceransomwarespyware

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2