Extracted

• • Target
    New Order Specification_260726.pdf.exe
  • Size 1.1MB
  • SHA256 d5b9fc27523798b7245b729ffa77b63a0f5f7d18087099725473db76e505336e
  • MD5 4dbed9523f931afb585b46fbab2ed851
  • SHA1 1538046bf03258f748a7f427e9120cb6e43285c6
  • SHA512 6a46ec6de86918ac9357fa9de5aa7df75253073e43fa721abd2c073b549adc2a7624314aca2f4afccb4b06514c62f662e24d3b20d718e6341dd9038b93a9c562
  • SSDEEP 24576:z732VvBbhecy+R1wMG3SCLxORsfOjsum5jJZsEx9lSg8d:/ApYtH3SCLxORmAxSjtx9V8d
  • TLSH
    T143352338AB45C553EF835BF93BBAF4B0136A2CCDF522E79656D65C4772E72A90800342
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionphantom_stealerpersistencespywarestealertrojan

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2