Extracted

• • Target
    5bddfd79c9fce9b9a38f93cb83eecc1571de4bfc78e0dd276945e4e40417a5f1.exe
  • Size 1.5MB
  • SHA256 5bddfd79c9fce9b9a38f93cb83eecc1571de4bfc78e0dd276945e4e40417a5f1
  • MD5 f0dbc760a3aaa11bf81363c6af0cc884
  • SHA1 18026fa711df2b9198606ff68f481a5c0d353641
  • SHA512 5aeeae6300743f61b9a8dc14c744aaaeaf6cce7c4aa8506f9c60f550dc68cce7a1d0cb8a0748f3d5172835500af94ebbb8abaac937e25e27b8c16eb77388d3f2
  • SSDEEP 49152:sUscL3jAR4lytVPD83KLeIcwZUp33R1wH4G:sPTRgo783K3ZUp33R184G
  • TLSH
    T1D37512882612EE06D58553B80BB1F2F48B394DEEE410E3175FEAADFBB539B244D04653
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionphantom_stealerpersistencespywarestealertrojan

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2