Extracted

• • Target
    OCBC Bank_Payment Advice.pdf.JS
  • Size 5.2MB
  • SHA256 ece2300137c322787cf99e97ebf82b5b4fc396ea532812007a5fb051e2379afc
  • MD5 44eb82e40b785c0c81bc5777b49c61a7
  • SHA1 2fa70029ee2d8ebb1abbc6b8c0115344ea0e7dea
  • SHA512 ba0f9a13e39f2f715ef954b332e0a22decebbb0fc85e7f6df932381bbbff399c6d828be587a017141b052296847aa1b497afaa8ff36ff2f6a86b5458ebd2a17f
  • SSDEEP 98304:tx2XyLG1y9v1uGB4YOwKO/tUD4KifnGdnuFwwco5oshNB8mnYXFGp6IwvY1dCoRR:tx6yS0u/YQ6tUD4nn4nuFwwclshNNpBp
  • TLSH
    T17746076103148531D22C9B9DE676FD24644E288754E9EF0D32AE83647375C27A3BEBF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionphantom_stealerspywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2