Extracted

• • Target
    FedEx345729876.js
  • Size 1.9MB
  • SHA256 621da58b9aee9a07b42dfc239e6d0bc99344e28c05fb829358691f7cb268e4ac
  • MD5 24d224ae3856ff207ad7f42d832399c7
  • SHA1 f7a5d39d532429309783b5ed8c70747479dfed04
  • SHA512 da5774ac7c894bb734ff0a2708cafa0a43fc3885350b5ef0166b3d6b427866e468466f013f07de7447f80acc3aaaa011dae397b4a42719644f71cffdc49ab0b2
  • SSDEEP 96:NovBam8wZ7Zvt1dW1CLavCbkTklYi1vioJELWwOQcUbvAPWrHE//OBXU:eZ5VrdW1ezbkwUisoPWuWE
  • TLSH
    T110955A61AFE96698B0951344153BFB0B749FB0396301E3AD7C6DB0F0BBF5C8194A98B4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executioncollectiondiscoveryphantom_stealerpersistencestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2