Extracted

Extracted

• • Target
    b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0.exe
  • Size 1.5MB
  • SHA256 b5a692c8627d6485773a81c1d0a5f806d62980b933d6b3ee6be2cdd9f5e91dd0
  • MD5 50f71f27947902cfb4cc78c6cb26d036
  • SHA1 f767c0e98900640bb48100cb139ed154e904077c
  • SHA512 3b6b45be09d7e942328cef0728125fd5cbf15e6973ddae868d6c29bb59bc4882d080bb413b2328cfd0142e1a77f5d2dd0d973e97a9d0c42b5ccff3d8b729a440
  • SSDEEP 24576:GmcEVM6EdWxSTwnGlhwCHNwwd2+njJGNdNqHLZH9nQ5uypn5VIJAjlXA6r+:m8KWxcwKrdBnjJkdcZFQ5dprIK9Ac+
  • TLSH
    T1DC7512945B29D506DE1157785BB0F1B813EC2EEAB912E2165FD8BDFBBD36E044C08283
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealeradware

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2