Overview

overview

10

Static

static

1

6d6e02dc79...8f.ps1

windows10-2004-x64

10

6d6e02dc79...8f.ps1

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f.ps1
  • Size 1KB
  • Sample260721-gpexmsf18n
  • SHA256 6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f
  • MD5 SHA1 SHA512 TLSH
Score
10/10
phantom_stealercollectionexecutionstealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    162.254.34.31
  • Port

    587
  • Username

    [email protected]
  • Password

    _|57(U?U1Ik%fx_g

Extracted

Family

  • phantom_stealer

Version

  • v4.0.0

Credentials
Mutex

  • 5SIO55YX92B6I5SDCHOD

Wallets

  • 1FN3a3b66XakLPbFykvawsCTtKPHtBHNFp

  • 0x7875027ea7D2c04535A6A78A83F18222Bc2Ce012

  • ltc1q4vhejh3avldylpkq9rj6dj4uv0wkj497wlhq0j

  • bitcoincash:qz2fhszqsdse8frnykllv5zwk9sjr05vyu6kkdd3af

  • TQUkvKgoq5tZGXwAhkgLwNzurj8dnonx5J

Attributes
  • clipper

    true

  • passwords

    true

  • screenshot

    true

  • smtp_enabled

    true

Targets

    • Target
      6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f.ps1
    • Size 1KB
    • SHA256 6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    collectionexecutionphantom_stealerstealer

    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

      stealerphantom_stealer

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks