Extracted

• • Target
    afQYhmOzSyGniT.exe
  • Size 1.2MB
  • SHA256 af8e39184404f87ea53f29454ca0211d51991129cda12387ee5ccb1a2dd83d7a
  • MD5 2519e7b005a0bd8e444eafa32d41141c
  • SHA1 8aab7cf8930de6e7796cab2447bcd0211e9f9ef5
  • SHA512 2170b9fb8ab5672ce00c9e4ac8b4dedfe1b7876beff0cd6801bccc27db8fd418c45f5d7e943cec7dad4a6f052396c86b089db37b320d8e7f379ef2c28822217e
  • SSDEEP 24576:GvSRp50166sYqKksJhmUMkj3RAKqK38GpkIdwFYZkpx93LyR:GUpe66X9ksvnMkOhKMMkIdwr9uR
  • TLSH
    T16D45011523069E41E0E687F6B870D37472680DDF79E2C3D69FEAAFF738293805854692
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionphantom_stealerpersistencespywarestealertrojan

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2