Extracted

• • Target
    31f433267321f551c97ffe2d78bd29f6551adeec6b9af6a1b95bee0f52a9b7c7.exe
  • Size 1.1MB
  • SHA256 31f433267321f551c97ffe2d78bd29f6551adeec6b9af6a1b95bee0f52a9b7c7
  • MD5 1885399e7d845a538fe8e915ce0b1efa
  • SHA1 73369dc8f55ad3bdf01bfbc94dc897b4bb312dd4
  • SHA512 9a2a97af587c026d75ee9f99fd7f1b689f21537324a535c40567d29e8e6892ffd8f5572d78fadb05779f7fc152dfbf9b25d3d26329b8e36d817476a5229be1e6
  • SSDEEP 24576:sOZWFeSkGu8X+ctDEn19AtOYGf3IqMdM:sOZWAL0onvArGvIqM2
  • TLSH
    T16945122816678807C4E27EB99EB0F0F497789DD4F239922A4FE50C6FF56B1427D80326
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionphantom_stealerpersistencespywarestealertrojan

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2