Extracted

Extracted

• • Target
    Specification_REF058890.vbs
  • Size 15KB
  • SHA256 4987c194ac063ee01681e560d2d58ba1477d242d257237ea2b69ae45331772fc
  • MD5 3911ec696a170118ffbf63d495a0c7fe
  • SHA1 f2de9bee9ea490c6f3976fa8dca2995b7b0bbaf6
  • SHA512 bdaa2fe704bf0182929e56ed47d2dcf4623238bada5ee51d1dea3770aa97dfbd59e37db1fd0079a19242b7933bb75b689a17e7c444ecc1e4c9dd3b5f326d8b69
  • SSDEEP 192:kd7F7jgTgBca7DsWly4uhROJ/Q1tG44S7gBLoEP5d4P+CXm4MP2yk:Cp8E+6Ds51uJ/Q1tR4S7gBLbxiW4yk
  • TLSH
    T11B62533AF64CDFF4071E10E141CB7D06505597A5B53A8DADE4CAC198BF2A7108EE78E8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionphantom_stealerstealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2