Extracted

• • Target
    _84cc5b5f990d3628396e0a22b3d5bc7c0414eb9c574eef1ffe109cf8f48fbfdd.txt
  • Size 4.9MB
  • SHA256 84cc5b5f990d3628396e0a22b3d5bc7c0414eb9c574eef1ffe109cf8f48fbfdd
  • MD5 377a7e79a10e8a8cda74417f139a805f
  • SHA1 3b38d3aa5c3e710f50d2bd386c9e6670409baac3
  • SHA512 5e72307df0eaf818df11d691efcef94a0019749e1302a9e7b5c342bc3d94afdd7636e3e4672c7e30d7bf7d154b87a9cd08409c937c92bb4ee6ce7c30dc556f22
  • SSDEEP 98304:I45SQqxwN8UYeQLjtv+YjDGlfiV19EQmWXnlGjH2gAFD4fS21YYdi1ek6L4J+Wr9:iQEwuUYeQ3t5OxU19CWXlG5Al49YY6eq
  • TLSH
    T1CD363A525368A5726629D79CD236DD74A84F604329DACF1C316DD328BA18D0BE38CBF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncosturadiscoveryexecutionphantom_stealerpackerspywarestealeradwarepersistence

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2