Extracted

Extracted

• • Target
    30dd5e040135cdbc455db82da73669757c4efa81f29e4c639f3ee98e24de140a.exe
  • Size 357KB
  • SHA256 30dd5e040135cdbc455db82da73669757c4efa81f29e4c639f3ee98e24de140a
  • MD5 9b02e39caa6d20ba3d1356b5ee665aa1
  • SHA1 68b036b67728f736a439a611c336bcb6f3d1784e
  • SHA512 8624e6d4384c14f99406ada2b8e3ec8db6dd0b13929b210a3917576bb7de4fb0b7f89c9cfe77250ecb3ef717dd41e5cb1f4089a07e59e42ca7ab3e6e4db211c4
  • SSDEEP 6144:mT4DtYa/h305o9fgqMUuBQWYmETqukoucsUpDj5t8vfMO3x9JEGuzj:mT+Vso4DUoQFmETbrLGkAJEGO
  • TLSH
    T1BD74F1282F6DD61AEE710F389DF9F731856C9EE46C628F8B671435257A30BC09C4931A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoverydownloaderguloaderphantom_stealerspywarestealer

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
  • MD5 6e55a6e7c3fdbd244042eb15cb1ec739
  • SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
  • SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
  • SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
  • TLSH
    T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4