Extracted

• • Target
    Invitation to Quote Procurement Opportunity.js
  • Size 1.5MB
  • SHA256 f11345c5838722112057b2c4bf7fc3f629a6d9362137bcae89cd16ba469b3ccb
  • MD5 9388b500425c85959c209e09eb4349ae
  • SHA1 412f76fcf658407aa5186020905ddb32faa9a104
  • SHA512 58473433de9a75fa55527386767e215a6df758dda3c8f652cf488b99c5cbc82e289f9a6ba10d5d963687b5138b84da68a8021ebc7076ad85538fe0be2f24a563
  • SSDEEP 24576:mrH/kQRrXxBSrFzjiOboEJtfC/SBCKz+NK6PRWvkLqZCLJaOzLtt7cQ09YjGDO7M:AfkovWzjiObootfC/Sx+E65L+WtdN09Z
  • TLSH
    T1AB756DF3C278263FE3F5F5948D11C8A8C656E26221426CA91C663CFD595FA07AC71F0A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2