Extracted

Extracted

• • Target
    Fedex70705345437_Doc.js
  • Size 15.6MB
  • SHA256 575892f6d1711a7722609b01135a9f7f175f8aaa23af1d60e3bedc273df0b129
  • MD5 71671cc89b18c6a86faed3349bf84d16
  • SHA1 857868536d694e73af918b5456f805b95406a94d
  • SHA512 60226c8989ba16e85bcf9f7186cfef03bb1a971c1e97cf07e182ac361cbdca7068f2465f376b9b615de6fda18c046c6e1fef37cbf69e8f69d0db283ce55dd3d0
  • SSDEEP 768:5CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCX:P6hlHE
  • TLSH
    T17CF63FEB32519595DC79370DB594FCB0026DFC31AA5A636CB6A20B0502A7FAB5C33363
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2