Extracted

Extracted

• • Target
    Booking_Confirmation.js
  • Size 1.0MB
  • SHA256 0a71bbd1903835fcbcb323179b460238184a4b406a3f3eab7341b0b003a26b6a
  • MD5 f7400cecbf4b7104499a7f9841827a72
  • SHA1 c885c038a1ecd7f59ff164b202ea5d58ded49f6a
  • SHA512 a683c4325a84d5e747b59be4058071fc902ba8873716ae0a76536943e8d39d08bb3cdd00b8e4bab74a2355b9954dc9fd593e1d775b94cdf849ffe202dd2272bb
  • SSDEEP 192:mRPQX2L9X4PED1srHL+WVCUfWTUTWIeUt4UfWKUeWD5crJZkL4g+6JvWogdT2JDd:qSpOTUfIUTSU2UfTUeyBe2J8lmEq
  • TLSH
    T14B354EBEEF508E0999411591CC974898EBB8A137FC155C6F35A293D8BBA20F811DCBF4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionphantom_stealerspywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2