Extracted

• • Target
    16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
  • Size 435KB
  • SHA256 16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff
  • MD5 fe2a6761da82e99dbdf387aba9b8dd89
  • SHA1 8903d9554c088f185ad7d8671d4e429adbb76e7e
  • SHA512 c80cd5f5921f4694e4a9302c80be6391a6013f270f96cac58161fb4ff1488f3c74e14a31cc70a079a2a4b1356756f121f8eeb25157bcdeafc4a7760ac4126357
  • SSDEEP 6144:6B+pgU8ZHm5GjJ6PTQvcwCW5YG1Fe2bdSSufD02Un0sllit+ma9/cqGIHwBRvkha:6gwHmebvT9rSkdSFfDZU0AVdkqCRJp
  • TLSH
    T1DA94E0154BA7981BD9D6173184A2DB325A74EE402D31D68B13C8FE4B3DF2BC0F946297
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
  • MD5 a4dd044bcd94e9b3370ccf095b31f896
  • SHA1 17c78201323ab2095bc53184aa8267c9187d5173
  • SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
  • SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
  • TLSH
    T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4