General
- Target Phantom_KeyTool.zip
- Size 103.3MB
- Sample260803-e9fcss11dz
- SHA256 990fccd70a959ee31f34d172202bc5424c37b33b6db22691deb0fdad62d80976
Score
8/10
Malware Config
Targets
-
- Target Phantom_KeyTool.exe
- Size 100.6MB
- SHA256 40cce8e68d245c215b5ab1da0fee6d4bb31401fbcb9e307d8aa8e38c98afa4db
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target backup_119.dll
- Size 728KB
- SHA256 54e13bb51627de012340672706585a17a4da0387b6e71242047a29afff4b0f81
Score1/10 -
- Target backup_126.sdat
- Size 739KB
- SHA256 6411419e9a797270fab0aa15837e646f7332a5ae1bd9c909d43761c36c0bf7e7
Score3/10 -
- Target meta_111.sdat
- Size 620KB
- SHA256 fcfc41c855c6cdd9cbf1ed0bf4133114532906a9ce3ba6c6a63187b5fbd0e700
Score3/10 -
- Target module_14.dat
- Size 715KB
- SHA256 c60a4a9b460dd6756ebf66d78f1214ec2711e032d42b330add351ffe8848f12f
Score3/10