Extracted

• • Target
    PHGF976456789000.js
  • Size 4.3MB
  • SHA256 73b497529654631f692fc80b0237367bf610467f6c790fb78bdf63d1e58c51c3
  • MD5 e90f5451ee637457ba2d589303de4881
  • SHA1 30fa6b31c11da95edd0d79bcb38ae23a96e7653a
  • SHA512 c20e63d01105db8a4ec91e33129a3f51ea7b589f6c895d4cc644fef5b69543bd82d0597b8d81f445c4ab892942b08c933e97b5ea0529b3715c29d9172699a7d4
  • SSDEEP 49152:DUNN62iaBDUl1gUXUdY2h06JUjNH5gOcowh7EalTpo3ih3QhMP9tn68P:4
  • TLSH
    T12526F2144F886F6F86AC1A18D0BF165EB3E107894467BCCAEF737D4A5FAA70051271E8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionpersistencespywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2