Extracted

Extracted

• • Target
    fedex6087554534.js
  • Size 1.7MB
  • SHA256 6b278084f9905518c01eee7886de87ebfa888398f4eba2b7e1f0ec57117025cb
  • MD5 279d2a252179bb4c98a9503c688da3e8
  • SHA1 ad3759dc801b82ebe860e458ffb8ea1252b3abe4
  • SHA512 93a0e549c79cc6ba620994d7a9bd1ba02f8439a69701b12a6b26646b418ab7744a96bd82373e2208da874175c6c8df81d3e07278363be0ae4a4c1cece0d5f498
  • SSDEEP 768:rt/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/v:mK9OwX
  • TLSH
    T14D850AEB8FE096CDAAB433ED6E46C45C8A70252F64DBA17B743817D9BB110C640718BD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistenceprivilege_escalationstealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2