Extracted

Extracted

• • Target
    RFQ-OIUT09-PR-26-13457-M2X120-ST-16853-2026-M0975.JS
  • Size 5.3MB
  • SHA256 1f04586698ece773cef92a6a6d5bde54099b590b14fba1618d09e2f4c2904275
  • MD5 3bd1ce6a68ca10caf1a8294389c45583
  • SHA1 27066130a2342171a5dcb1b367cbac7cfc6b15df
  • SHA512 d650a5295b560019ac8b6f622f6d071e758fa3f3c3d5b329ec28e18a7b3e78d205b7e44e5115e4d18a12eb6de3151d339b523067614e196272565eaa21f29d31
  • SSDEEP 98304:caSf4bhwD8FP6Jn1W/+XWHxaUfVvkshgDOE7q5geqFJYmahQa3gXFOiSXel/zTnL:caSw+4FMw/X98s6aseqFJ0If5VK0Euxt
  • TLSH
    T1964638556B6462327352DBAE5276DD38E40E601329D9CF14328FDA247A6CD0BE38C6F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionphantom_stealerspywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2