General
- Target Phantom_KeyTool.zip
- Size 21.6MB
- Sample260801-e5m7vadf74
- SHA256 b2714f93b5085cf5bee17827165497953ee46e6667d447351456c24e80e55bd6
Score
7/10
Malware Config
Targets
-
- Target Phantom_KeyTool.zip
- Size 21.6MB
- SHA256 b2714f93b5085cf5bee17827165497953ee46e6667d447351456c24e80e55bd6
Score3/10 -
- Target Phantom_KeyTool.msi
- Size 19.4MB
- SHA256 6e1d0af7d3e09376aaa21df8fef6db5b453573e204f059536f9ad394c5de736c
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Executes a VBScript file via the Windows Script Host.
-
- Target backup_119.dll
- Size 728KB
- SHA256 54e13bb51627de012340672706585a17a4da0387b6e71242047a29afff4b0f81
Score1/10 -
- Target backup_126.sdat
- Size 739KB
- SHA256 6411419e9a797270fab0aa15837e646f7332a5ae1bd9c909d43761c36c0bf7e7
Score3/10 -
- Target meta_111.sdat
- Size 620KB
- SHA256 fcfc41c855c6cdd9cbf1ed0bf4133114532906a9ce3ba6c6a63187b5fbd0e700
Score3/10 -
- Target module_14.dat
- Size 715KB
- SHA256 c60a4a9b460dd6756ebf66d78f1214ec2711e032d42b330add351ffe8848f12f
Score3/10