Extracted

Extracted

• • Target
    Letter dated 24.07.2026 (262244)-company.js
  • Size 1.6MB
  • SHA256 5d27ce36bffa352aee8c1a46006a5e4b69f03f0fe9e85932d48f4c58dc008bb4
  • MD5 ba1a4ef2ede227f66b34489a6ee5d00b
  • SHA1 304172e14498467b22feb1d550c1f16356b178e0
  • SHA512 ff0c5a8ec98fd7065ca498957ebb6a7055053614e161dd154052dba37f563fd7b81e3675416a1e6fe654b3e0164768f14cf1e8d03e4da64c4c378e7443f55d26
  • SSDEEP 384:U888888888888888888888888888888888888888888888888888888888888889:WH
  • TLSH
    T1E3758DFAF13F4703AD751600AE6E5C0476C8A57A4F1FDA1BECD0A0DC65A341AEA98D34
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executioncollectiondiscoveryphantom_stealerpersistencestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2