Extracted

Extracted

• • Target
    TNsfm0sOE5yr04B.exe
  • Size 1.5MB
  • SHA256 24bcf4e8d33ea1e417d0a675016c6103be753ae57a6c2025e8711f0da17bc57f
  • MD5 6019f364c9f02fa6b515eba7d1eec5d0
  • SHA1 47d324e3678336ae4f01acdd1a4b6dc5b9e2214e
  • SHA512 52ba77e5ffb21935f27a5a40ca11470e995be1e64a6b73605bfd1f006b8f609b2232ed8b78a883589778a96c564800ded654516a022287a967e17e34435b2cf7
  • SSDEEP 24576:gTP2TB0FCdzXCXLyzExt74Ht8r3FH/rKcihmjWdyBvYRYSou271vIQiW2:gaV0FCdrC7FxhmIFf8hDddK1wl
  • TLSH
    T1B57512583365EF16D5662BF45C31E2B01BB06E46A421D3028FF6BDEBB93CB4269142D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2