Extracted

Extracted

• • Target
    eBil CUKAI TANAH _ PETAK WILAYAH PERSEKUTUAN KUALA LUMPUR TAHUN 2026.js
  • Size 2.3MB
  • SHA256 49a35176ab391f750731f57ab10579dc1a83d8da76226c6e72d3ef938a1e7802
  • MD5 c2c558ed74aba174e56ca8a33bd59424
  • SHA1 bea9ed2116123a6aaddda97b5df85e5b4bf266d6
  • SHA512 72b0e32b96a580fefd4bd99c4bcba635f8a3d68d119d776737a50f3b9ef7d46489c0bd11b3bd76d2e3edbc3f17f9fee81dcac4d6d5995348aff99c6655358c40
  • SSDEEP 192:Iggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggz:Qs2nB8pWZalTNDbK
  • TLSH
    T112B501EBF98680CBA6FA2BD7DD1487C0DD7934355CE1828D326459E88DE1C23512BDB8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerstealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2