Extracted

• • Target
    PO.exe
  • Size 1.7MB
  • SHA256 ada33b7d759984eb9e1c1ac741f7e97396f100e77ec891270ac5954cda59e356
  • MD5 3d7353c22708f1448f90128b28105f07
  • SHA1 4e27be32686b82daeca37ab761be020ff8fa8499
  • SHA512 e42fb9f44a131dc4af24ef473e3922a028e9dca299c9546c6c45b511c1f193993733a4bf0fc4efdfe322f0c06a8b98a2a854adf67206d7b11dba517e5d62d591
  • SSDEEP 24576:i5MgYqfK/zIVsmQb2hGUNlerBlRqHN9tayLVXfnb:eZibqhGml4qEwXf
  • TLSH
    T1D285F12A0DC74694C564BF7497B62FE812F1922F0112E76B97D663F8CA0D39F3642263
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdefense_evasiondiscoveryevasionphantom_stealerpersistencespywarestealertrojan

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables Task Manager via registry modification

    defense_evasion

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2