phantom_stealer | cd336c8d2e301369fb27c5cbbe02dbf73f5bd797307cca781104460effa803c8

General

Target
cd336c8d2e301369fb27c5cbbe02dbf73f5bd797307cca781104460effa803c8.exe
Size 1.1MB
Sample260810-spfdysbr7z
SHA256 cd336c8d2e301369fb27c5cbbe02dbf73f5bd797307cca781104460effa803c8
MD5 31069d2d180bd6fcd8400be270b98be9
SHA1 8c8b3e9fc1b3d02ec2535334eed44155318076db
SHA512 0cfc22dcd41a770c8f54ee11ff70764137c74a00067791ce439b4ff6f8bd8662ab471b0ce315eb881d87ba203a77c752aa6532b47e726e82a80fb7108e952661
SSDEEP 24576:gUJ51iRD5Zhi/6fjWHcyyMsXQGKn/+EMvqhTNpw0F8Ez:d9iRjUJcyyMsXQGKn/+EAapw0CE
TLSH
T13E3523A41752DF12F8761BF42963E1355B783D9EAA36E2460FEA6CDBB393740A014703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.yornsub.com
Port
587
Username
[email protected]
Password
y)*a!ped^5p]Bu6m

Extracted

Family

phantom_stealer

Version

v4.0.0

Credentials

Protocol
smtp
Host
mail.yornsub.com
Port
587
Username
[email protected]
Password
y)*a!ped^5p]Bu6m
Email to
[email protected]

Mutex

ORPNCINX0NSABPH7NDRJ

Attributes

enable_ssl
true
passwords
true
smtp_enabled
true

Targets

- Target
  cd336c8d2e301369fb27c5cbbe02dbf73f5bd797307cca781104460effa803c8.exe
- Size 1.1MB
- SHA256 cd336c8d2e301369fb27c5cbbe02dbf73f5bd797307cca781104460effa803c8
- MD5 31069d2d180bd6fcd8400be270b98be9
- SHA1 8c8b3e9fc1b3d02ec2535334eed44155318076db
- SHA512 0cfc22dcd41a770c8f54ee11ff70764137c74a00067791ce439b4ff6f8bd8662ab471b0ce315eb881d87ba203a77c752aa6532b47e726e82a80fb7108e952661
- SSDEEP 24576:gUJ51iRD5Zhi/6fjWHcyyMsXQGKn/+EMvqhTNpw0F8Ez:d9iRjUJcyyMsXQGKn/+EAapw0CE
- TLSH
  T13E3523A41752DF12F8761BF42963E1355B783D9EAA36E2460FEA6CDBB393740A014703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery phantom_stealer stealer
- Family: PhantomStealer
  Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
  stealer phantom_stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Family: PhantomStealer

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2