Extracted

Extracted

• • Target
    Fedex6577858874.js
  • Size 14.8MB
  • SHA256 7d86433b6d5a41a027a778d25df88f47b3a2c8d511f3169ea76bca9f7368d8af
  • MD5 42ba4ad3f9520ee54f5a93d2101ee967
  • SHA1 eb430f8dd761d4ac73da981dea26d1847e9b3635
  • SHA512 ebeb2cee54d40cc5fe7667264398a16529f090e1c2dd5807993594054887cb94302f8aec465994740b0edb7215e14ac50db071cf09fbb910650b062bb4a65a2f
  • SSDEEP 3072:J6LB9tIBnir7TkUwG5xxQmr5YxUtr5VyB3Nr9vSHE95VLmfsJBl4bxEAEG2MFJDh:U
  • TLSH
    T1FCF6C28B93EE0F0E9CF22B7D01522CD1BB295B3995A7978C3E531E49ABE66034C1057D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2