Extracted

Extracted

• • Target
    Order_handling_depo_7120.vbs
  • Size 15KB
  • SHA256 ddc027aa383a4248f9c5e4479e9232e22555aff8d1bc760d61bcbfb00b38839d
  • MD5 22436af70b5aa9eddedcd0e144bb0fcb
  • SHA1 27b5d3ed51a9245c29b4a2eb35e6500fba74d398
  • SHA512 ebb177dee05c0b6cde28e70145594095b9916f109ed8ef4245ea446809fbe6703373331d34d25d268c0144145ec684e968d35816c9588ac9da674dc6a9654612
  • SSDEEP 192:Jiogb7/DlSIN9wkhfckAX0oczynCz6Pe6umUFE336hP5d4P+CXFMPug:Kn/wIzwkhkkg5fPeja336hxiVy
  • TLSH
    T10A62653BF60CDFF40B2E21D5519B7D0210599BA5B53989EDD8DAC0947F26B008EA78EC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerstealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2