Extracted

• • Target
    phantom-loader/Phantom Loader.exe
  • Size 10.1MB
  • SHA256 72935b04a5ab38bfd9240514cd205935f7ffe921ae5a61d0b389495235feaeb3
  • MD5 512bb4a122568ab91f86b9bb716739a5
  • SHA1 bd6c7efbdd13e521de1f00c22b2bc8104e2c10c3
  • SHA512 c5e8f44a7e49e21ccff1a9667050676af606e4c7204223ca5662cf1f65007c5da7ace6555d5be4bdcf3ecaf782f4ef6b6f642d77d84773fb2835105085446f17
  • SSDEEP 49152:VqBFd8CTIhkGRarZdT5W8OJLaZAeo3BSw6F2YxpjceVofpcJZJ:VevrvLceVM+JL
  • TLSH
    T148B64A03BD9148E6C09AA63189B652567B74BC0D1B3233DB2E90BBB82F737D05D39B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2
• • Target
    phantom-loader/Qt5Network.dll
  • Size 840KB
  • SHA256 335cec3a5f9082f083190660932b6641f682f4c5818ffbd6ffa98c9d0c24e0f1
  • MD5 0fdda3a8c8be28993b156b24b300ccdf
  • SHA1 57fe6cfd0b28708d23ae560675d4c462127722c8
  • SHA512 4ba8b28ac903d087344185b77144bfcbcd5bda11efb2a8d45b942363b8a13c7c4fb56820644166c7556fb44b68a8786ebb10b8cc4b3557247aa85214289e4453
  • SSDEEP 12288:/fGeWXoifZwygBFp9RsVqSA3jk1x5X+JPnk4PpazkoLhVY9hqivwlsBNzARfG2:/fGeWXoiBwHbHEgqM9BNzARfG2
  • TLSH
    T12C055B52B2CF00B6E58D61FA881DEF67E63CB114470656DFE35CAE1663213E11E3E286
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    phantom-loader/Qt5Svg.dll
  • Size 253KB
  • SHA256 ea31035fa96ba656d64b58d4f1a9dd210df7154afad3d4f96ee36b41584e4360
  • MD5 06cc5d18a496520e05bcfee1e3169535
  • SHA1 98ba5d0ed52499a845038c3b4bcba356b9339f11
  • SHA512 154a2fdbaa045df6289476420cc4045905a866cd54d756dcc09e0ea79f2cec7f33c748534f47c827841e35c35f71d462cadb801a6b99bf72c162c075d786fdbe
  • SSDEEP 6144:kKD4dwpLEE61jMW52NP5xwuMnyOWYGcy8Dv4Cnke+9oCsGhvdw61IwxP4zd:kKD42pLEE6mw2NPnBMIBrU
  • TLSH
    T116444B52B2424DB1F48BD378591F5A579C3EB00A037A83EBA3D99C21D4683F76DBA341
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    phantom-loader/Qt5Widgets.dll
  • Size 4.3MB
  • SHA256 400fa69aa8803f6c3a6f9a5fc956475d0396095c4b6d4665b7aa29bbcb8e3640
  • MD5 f697ffc85fb86d72654c4f5ba4e1bdc2
  • SHA1 670657f598d408ab232dec75be6fc7983bc5ce4b
  • SHA512 47513892c22a193c51ecf09c8f3e4c4271a92be33b7b7d535290ea75a1498c5531881a26a85dbf758361e6892abf12a796f1c5c284a34f1d173d61d2012325b7
  • SSDEEP 49152:Zhk8cs4FhK1FKBxR8Lcdm0OTqZ7uA/GrXHIaTU+cDZ0V37SUJ:7k8ymoBxKAdmL8yONaQi32UJ
  • TLSH
    T180268E83B2C101F1C8859275491FEF5BC5BBB1164B5652DBE38CEA0368683E12E7F687
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    phantom-loader/assets/archive_30.dll
  • Size 784KB
  • SHA256 cf4577ab265615c7745ffc64068a90025c973a5335796a88b5e4adefa6823e2e
  • MD5 776523cda50fc3e88c63d5f011f1d6da
  • SHA1 daae350b63a78cafe077b28cb6dc2c9c47c3cb47
  • SHA512 ecaf65648adac0150ede4c40edb5f731be38aa835a0180c7d8a8f6e8b48535daf7b9ea7d134fa6ba1366569b570b8c2dc815b48b5fa707c8c74bcf5566c70193
  • SSDEEP 12288:7QIu/SoQhErK7yB3+GHxCFJq01qKY48DZlC5z7o13AZ/B+wS:NwSoQQ/+uxCFJq01qz9l6a3gB+J
  • TLSH
    T1EC0533CC19C27F0638D885C9486EBB72F5AFD23338AA31950AC4C437F97978966D3895
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    phantom-loader/assets/config_5.dll
  • Size 949KB
  • SHA256 f577ce7ef4abaff0069765fd0c86086eee77e1ec89047e25dc6c963303e956b8
  • MD5 f13ad5e7bfbd1df5a008044cdbee3a3a
  • SHA1 b0d1da705d8eb013e2eb5f0ed89975bccea13bf4
  • SHA512 8c595e2b54110bd06acd5f5aab15383aa535b05354a6b1901fc23e3f300a8649a751b5611854ac3f2ec897567ecbef84575b6c767dbceac489839d384b76970b
  • SSDEEP 24576:Um7xc2VZ/RO3JsJTVAbLp7D6AoqPwcEe8XdkvRr0X:x7xc2VZ45iIjPwcEe8tB
  • TLSH
    T1F825330955620B38FAC55A63B5E479C7505B6EE3FB58F1CE8FBE6220F32940215421FB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    phantom-loader/assets/core_117.dll
  • Size 1012KB
  • SHA256 ed94434dec77477966fe046407cd3df9b897a9c0ad164440e16762e8d0fbb334
  • MD5 f0208b30812308d504538b2d58ce9715
  • SHA1 8a1cec6b38458824d4f7d7901d582122a380dd47
  • SHA512 618604f44d775a5e36b383505178d9e545bad9a92565c0aaf90ff2bfc8083792cceaaeb0f06e49b3ceea2f0eb784c48772cc3002f37b09c70071d52fcf8880b3
  • SSDEEP 24576:dY4yXkpZlqshHVeA8K9BWN9kBi148i0GAHucsnOvbhqM8eh6p2Uto12:dY4mkvlqshHcAzWN9ui1487FO7shqlMk
  • TLSH
    T19C2533B3D88EABB01FB0839BD59436F474746B4CBE420AB0BB7C7061B3D4591A1E846D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    phantom-loader/assets/core_43.dll
  • Size 750KB
  • SHA256 8b16a194d37db0fb2f33f75d6b39d8dc3daad53bf50bfe9fbd0b21e28ad83ee6
  • MD5 f74a83ae87c43423d9fb9e17ecd444a9
  • SHA1 526922c13b544d4064c944b1cb321f647b1d1ce0
  • SHA512 8704cb784e12d2373afde9d131ba486554f19bd68510b4c034048fded54d425c8f954438c1adaf766875c9b1984f84ca2657809f6ee04e377e1b03722f5331ee
  • SSDEEP 12288:Wxgx15Umd0B05qmQJc3xDCybIyE0guSyv6Q3MXkB7tpIpU3gjqIaKEZAFPwrdEAu:GWjL53JbG0b9T3QMIpU3Wq0FEQ
  • TLSH
    T17DF423A3D10B46264C569BD5DDFC0DE9CEE1BEF24833F7A0EC62AE8963054F28525274
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16
• • Target
    phantom-loader/assets/data_16.dll
  • Size 548KB
  • SHA256 9ebb077ba6e2a72c6aa231ed58272ca2c5c531fe171e3857409517b8f8f0aec9
  • MD5 4dc993d7a7f051beca5f0bb75fa0be57
  • SHA1 72a25155b607f20f8290c02e9243a0f491fd2a64
  • SHA512 eb300d53f7f58fbe97d4fa3c6472e180a3c026be7dae7db7269763894284c30d0197ca208e9d54e677b73349d459b91af1c5a6ed2ab36c5ac22e31a03a034ed1
  • SSDEEP 12288:9P7UBDvTrs/FvjBWmbRywvWVAZh4x9MLRB/WnelZBri3VwA72GwXqK60x:9P7UBDvTrMFvjBZbRyiZFWne5awA7M8K
  • TLSH
    T153C42362A362300757A4E894B4483C9754FEAF668A3B5F4A5CBD033D67969FB3137308
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    phantom-loader/assets/lib_20.dll
  • Size 732KB
  • SHA256 b362b63959677878575024de30373c078e07d7021a72a60257eaf7f07c616439
  • MD5 a4fefd6e0c6e666d72be460bd77f9b8c
  • SHA1 3aa4f392eb6e4ce5a85da5a4baa27e984a90b660
  • SHA512 c0de15ed7e0f628b9e8b1d07bef578e459665e7f4a3477f2fceae15adab63cc42dbd4f2b1245e6a37cb29fb5e642ae3179eeb11a643c7b340dcbc0344f522925
  • SSDEEP 12288:UTvEEzKXsSHHH3YIgAr2kvj7AR0o32YeLSzRrYkf+JO1bFECyegZ87/4IW7lGEOL:UTvKPHHXYC2kPAR0HLSzdlbFqrZA/4IV
  • TLSH
    T1D8F43311CBE83B9E43ED592D745027AF6D8C98D2AC1E68C918E4693E78CD544FCB40EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral19behavioral20
• • Target
    phantom-loader/assets/log_66.dll
  • Size 767KB
  • SHA256 259845820f5eaa0a14048ac118c0cb359e942a1e8a18c64f03b961a8e2d56113
  • MD5 cffb008ab375db08aa281d759327fd14
  • SHA1 95e17ce4b4333dacb8ad134b2dba8990454f3637
  • SHA512 d5ecad46e13defc0e9aa85779b2e0ae3e235b74c9b8c1d4ab37ba209bbf4ecd33468a645ff18d9c9fce1b69a6a3b239b37cf748bb32e8354e3be061d41fb37c7
  • SSDEEP 12288:NZj1FXyfBWcjla8IVSCKLXWEuGG6tikNr3IRSNhMF6BNr8Hcx9ISRP0v3H4zZcrp:NJqlZL0SCKqEuj6t/DxhMcBNr8H0KYzm
  • TLSH
    T19DF42337D6C9D776C0C0477B280B85E0BE8788476ABEE3197DD8704E9086D18F1BE95A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    phantom-loader/assets/node_96.dll
  • Size 547KB
  • SHA256 915621aba477fd81cd4d416994c325624211d5e1f79c7225d37bf9ebce55ef93
  • MD5 87acdce8a7cc8eda5673579ca2b69b6b
  • SHA1 7d80f62c8619b82255eecd8e2c4d04e3713d3c52
  • SHA512 7bd6fa2d2ebcb5defaab91e940ccc0eb21ce9e6aa9d319b324476027543ae739cb13738addadd4852a6058769457c856d9d522d43ef0de638b80680d488c2a03
  • SSDEEP 12288:BNBK0C0blIZeUVAl9uC+YJbo2nGLJ/bTcDcapZTYGjQeTCVmYwT+:BzvblIZeUmn98L5Qc2+GjjTCVrp
  • TLSH
    T123C42339519C54B02FAC1C8ED79D4367AFF40DC1A47DB292536CCAAC9E4061ABEA53CC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24
• • Target
    phantom-loader/assets/resource_47.dll
  • Size 718KB
  • SHA256 a453a6271edb8fa5b9774937bec3c63f200511fa37b87ac6478ed0e0362813ca
  • MD5 1db759ba4aefb5cd90b9f7ea94f1ec8a
  • SHA1 c4fb7dfe388cb95bd5e53316c9890478230eebaa
  • SHA512 54efc2e1bf7122bb1dc7646257bb87794c3f380408d6713ff84883db6003c80c3bf2273f7f5e1e5ff1c297496ba024fcdcbb6b145fcb40698b4a03d3be859825
  • SSDEEP 12288:yNLL2CNQV2A469IycJPWZHdbnLguknZnX3384OdFT/ferdJ18qHhLCTj9rsvNLP:CPQV2AvIygPW/DNkZnX3M4OH0dJCqHhN
  • TLSH
    T1E1F4337A760538779CBAA96846F778BCD85D48E1F0E00FA512AC1BB1B43BBDE204E045
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral25behavioral26
• • Target
    phantom-loader/assets/settings_127.dll
  • Size 621KB
  • SHA256 352bd91d42af9d55d2b679b9cb15a17c0ff861d368979069c03f3bdf27cd019c
  • MD5 40fe46c6e2bd827f07f5d473e8f97982
  • SHA1 3ca6ea48dc97c4d6e96101f55c5da166340325ce
  • SHA512 feee4821ffd5a4a2abd4240e448a7a7943d36ace5a41a4916809d2862c787de943da984c7ccaeb3fd8a9e0bacca867fa29d0331bf9c19d75d9a2198d5e423863
  • SSDEEP 12288:XHSlC5NhZagccUQob5SHDg90RAWHHSDEEsN8lQiexhmq6SvE9zX5V/AIXv:ClONPcf5CDTSWSgVN8mJ/mq6SvE9TPoW
  • TLSH
    T107D433BE8081890D9BC334279E04F683D9320C4D8B5975B63FA1B638DB6D6532F7C19A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28
• • Target
    phantom-loader/assets/stats_93.dll
  • Size 970KB
  • SHA256 545e35db8d2492f76bbd62d56cf89c1260ffd8fc86bc9e63a986ff71656129ce
  • MD5 45133be8e9b45d4c77ae481c55766def
  • SHA1 c997761595a8d75b55f86bdeeca27d85a138aed8
  • SHA512 2dd68edbed6d87b56c5ba10d49f570bc6c0ad1f17e29d74e5755ee431d31ade3a99f46e4dc91e9381b2f9c264daed198695b6cb2f805d8fde58fd0c4238fa0de
  • SSDEEP 24576:lZoNSWURx+6MoEITpys7Ut99Iehbggiy9+8YNwMVYu8Fb3K5CUrl:HnBEAgW07IeygT9+lGbbaL5
  • TLSH
    T1A625338F44692DF5EC5698B229F0B49C5206D856D690ECC28C3B1FD2D8B025F778F798
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    phantom-loader/assets/utils_70.dll
  • Size 536KB
  • SHA256 2e68f8462163c2ec6278f7fcb313ea52457ab21ad1ee6d563a1286f3b5a94ad5
  • MD5 0ae86f8cacbc6bf6b6058183a8f0a632
  • SHA1 65f27957dbc5adef90294477847cb7c7c47363d9
  • SHA512 39dd3ab048164a172e9f5be495f9c3766fc4521ac8450edfccb19e4b046185b6502c10dd3a3c61dacec536ea307a59135a93fcf57efdbd8ad6da5ef0193eeb28
  • SSDEEP 12288:RN2ggkKdUFONUfjtJXgI+mO7g+p09QoPLXvnCDLXf1P:RNgknFO4vghmO7O9QTHfF
  • TLSH
    T131C4231E2E1E79CFD0AED5F0DEDB09CAC038B212B645F21F3E219D64A13477A4AB1519
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral31behavioral32