Extracted

Extracted

• • Target
    Quotation Requirement - KAIZEN-2026.js
  • Size 1003KB
  • SHA256 2a5973551755b9107ea9180b613a9894e10aad9da007dad086c8645e4dedf5c7
  • MD5 1a5e7288df7d7cb53718d59d2fa73847
  • SHA1 9fa12ac68a7d3629a601d384518eb0126cccf678
  • SHA512 ea05a052b1ff2f031210845e23a5c7825de8c3b8e8b25aba0f9ab39ba39cc291f769d034eaec626aeaf6ef33eafb34732570aba71c6ae99abbc2365224e5952a
  • SSDEEP 3072:00G2SbL23vFgSNr9dl7uUwoN0J+P/CDDjSbKK24Iob1Yi5u1Sg5udsSeS+wT5bIe:8+KUlkTplUqZB5KS+
  • TLSH
    T15925E8CF6371091C748A7A0FC8386E9E7A96CF830510BCBABDA45947C51C74253B9B6B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2