Extracted

• • Target
    doc_4746573545637383835744654747.js
  • Size 1.4MB
  • SHA256 a1a2328ed433e0c7f7ef81919fb3141bf2faadeb4a714a6dfb56bba76cf3b8af
  • MD5 42d1e1d451e44aa2c89b5a48e9b78aa3
  • SHA1 cdfdda1b01362efb85a24b4f937fb88bcfb1ed9e
  • SHA512 514d030e4514dd966246c90ce2e2daf8a97ebb0d582e264b6183e1c70eed320567170eca45c69431d07d180ed97fea76d0d449156e59d13f98fcc7b12f389a6e
  • SSDEEP 3072:woYzHe9t7UeC6CddQzbj+F0/JvsU0w1ZThOpQMO6J6WO8aNAFf9By95l1tLAt5h1:Y
  • TLSH
    T144658D7ECC28123FC2FBD219C9C64907E9514E6F271CFE4660EAA3A66E16142F5C215F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncosturadiscoveryexecutionphantom_stealerpackerpersistencestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2