Extracted

Extracted

• • Target
    2026-09, Vinç ve Kasnaklı Ekskavatör Onaylar İcin Fiyat Talebi HK..js
  • Size 2.1MB
  • SHA256 51cc69616520ec253e9635ed5d76ad5b03f54f5fdd4c4646e40398a9a8daf188
  • MD5 7879683aacaa8ce943d000dbfcf73d57
  • SHA1 5428c6e4babd5eff396b136248ebed6887b07bbc
  • SHA512 4571db6300e01d27a383b26e6a5097ecdc7ecc904a5b0208ca723ccde649eb6b3b742f4a36fde962b1aa4d7d83f5dd92d458f0ba23b9d39f39f8f2ab46e662fe
  • SSDEEP 768:PTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCe:q2yW
  • TLSH
    T117A512D8891F8CF3A3E84BA7AF16A21972640D837D370D5D2CBD39C22EDD85407A4D29
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerstealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2