Extracted

• • Target
    Invoice #2776-6543.js
  • Size 965KB
  • SHA256 4f3e236f61411c9e65dcabf84ad38b22b71f4b64abf09ccab9fbcf70d038309b
  • MD5 2c669839663b58fedffcc6b3888f326a
  • SHA1 85ffa12046040eb3a5d1ffb34423e3f0abf54f62
  • SHA512 d999cc28c848384fe972a43ab2a6d5808115d87e30825e1b58cc154be16bbb72940ad10c53138560914b4b9789e8b965f0184e7afc78b4d37afdb1845a751150
  • SSDEEP 768:cRbgBRMgBRvRRUOlrR4gBRDRgRRJRRqgBRvRR1RRR4gBRvRRLR4gBRDRgRRqgBRk:U
  • TLSH
    T1A32576CD4F466235ED548778DE2953DD56FD21CFD0A8DEAC3EA09EC8016E0A42426CBE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionphantom_stealerspywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2