Extracted

Extracted

• • Target
    RFQ _ SK PREMIER - PR-SKPREMIER-20260724-066D - SPARE PARTS AND ACCESSORIES.js
  • Size 2.4MB
  • SHA256 189e7289fecdf6099e9b1dd6d4dfa409f482718a0a3bcef45afa7f7c3ad5ba98
  • MD5 301a89fd97c02b78e982578bdfc919b9
  • SHA1 2a8947f607bf0c42f0dc64a5394d4f9f6ac04569
  • SHA512 a11e2a866f1f510a2141edc22415d65e1aea76954aaa4f32749db98d1043e52df1d29a164426714f8ac9008babb54608113425483a27b99269b6f9871f99cca3
  • SSDEEP 384:2RVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVt:O3
  • TLSH
    T1EEC5112D6DF684E03C6B37AE9C4A39E67DD43E4ECBA28C851F7065C63086D0C4A16E35
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerstealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2