General
- Target 3776091d8713b1d8d3a605bbb742412ea5db54e87f0d90e529af2eb03b69abb6
- Size 102KB
- Sample260811-dfct5sthlb
- SHA256 3776091d8713b1d8d3a605bbb742412ea5db54e87f0d90e529af2eb03b69abb6
- MD5 aab8a15b5bb359319787ba8cdf772656
- SHA1 3702ea3977a98e1b9385c1317b70d078bfade5be
- SHA512 74a7262954e4d068b7df4c602b4e8231931d70305f900396ee48632b2b9dfc9aec3db802eaed63613a5eb2e34de162118855cfff6494951141a9a85e500eec2d
- SSDEEP 3072:Rs2T2pFgDXnt/88MWn7VH99uEaQ/q5xK93x:ROv0n28MujcbxK93x
- TLSH T1EDA3122D2D7772CE1C8ED08593A08615D8BB74FA16AED2623DE53938E030347785AD6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-JTSA 15938.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
RFQ-JTSA 15938.bat
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.trimnt.com
-
Port
587
-
Username
-
Password
her6+eMmNJbim&[F
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
GvnHcUROw6Pcih6HwY0rEpWUXo3/axSz/ToyZIkLTq9QAAAAX6rN5ZnJgYKiA8C06yEztrUjFM4W0MRjboNfRpwYHBsJ1UYzLQPRLki9k5dX5QoN/eKJPeGs7kJ2gdIjL+7emmVkqxgdRPAZdUUvjwpLBbcjFxIRzk0rmkO5z4VK06nc
-
Username
HyZbuZW4URd0sMq2cKzT7GMpxkawTghgZSRFWbIJyQBQAAAAQ1cXF6G7v69qJBtlpbZ73z1h+B7/Ju60MjuORLb6y7Dfn+uWQwgafscjV49jxYKCNPJbA8sya3pprBknYzu0jjp/WF2N75KjxzRNUbvQjzyQuv3U7IZ7Upje/A2iUo5a
-
Password
gzy/TnRvsw56mFR251My7v9hqLbpOPLzyVNw3pUlvYxQAAAA4CJmFHNVV/0LhyjQWwIZ0DqZP21OKqOBcyIoNJn4d3U+Vn/RkdF/BLhMhckWQoptUDKEFXjiqXD1apy/CTi51c/YTZHUz4WA6RIWzbjbn0WGZejeu6aqQ+HbJPCHUQZzF6WZo7K8qS0Y7Pvn9TzZ6A==
-
Email to
D4YkHm0Og6XlAGOa/SPxQCoTsE0utCkmoLaH1bo2kJJQAAAAN3nLnaLBnypHJljKydOKAbslf/HziY0fyy8HK57KYkKvwA2jJST/u9GFxKe4bkBmw2sth8vVJCWZlIy0OdGnexStY08AAQTxVxbq0AxFuVdC1HTYo9ypXgzmUIaH+HNuw97kIQNfGKamhbUtflYirg==
-
Protocol
ftp
-
Host
0
-
Username
0
-
Password
0
-
S7FHVGSFZV79T8D372PY
-
3J6rebMcc9JpV67Z/dW8Besklg2H2cpQzKIMeYSuER1QAAAAUx7EY5VCjmSWLUA1gGPRKBKh6tbl2mwnmewGr2hdpVNYadWeyGeC1c2jGHQkl5dfoRpRfPrCPe7KHXYj4Quvlrdz5NckBVbZSXvfykBV3Q6ngyXN+208oM5YEGX5yah7e2tPvktXkxzFwb1uU6v7tOqTemcuAD/AHsfshQP6VqQ=
-
2yC5mKgVrOv0B0HwwRvdA+wNwxWMNxM/LO9CxMw1dfZQAAAAH9Mgs8ds8GavB6Sgtz77qhB99UDTBJcYV7Y3y1ZDiQ4R6HfqIQcbv+txNlhPyFTxjZRwH+jdXzWIF/VY9MN7OCFLijJDeaAqlOnt6WZT+FTM6+3F5zhKz88cC0rPREbsiN8CtK+hk2tp+OqHkp/1ALX1+BWIMYfK7zUe2jwmfoo=
-
sJQ/ndefDuHTj8vyO/RrIpZ6EbwG1sT7Br8d0+LSpYFQAAAAhPdzAeazmc82GT17szKz3IbnHNO8Fn157jkel0ICDWuh0R+6oIvPYHOUimXwniG4tcmiuDZLUyrxp2cC9A4NgRyo5o4nNFSUqTXG3Aecu6zEgiovr9nCXBqTyhvuzFEqNA56fr9PTsBYlOQ7agNUwYiV3M5cVrge8H0OLOBaqLg=
-
r5iuHWuRqBVLClF6p06ays7LkgDORUSUyqPDlV2CA8BQAAAA93EVKdUZppOoXsA1axC1YwrRJRT4vmcDQC7P6W08IYEYcbLmsJorOKUyhlVUORe0qeiIlxQubDsSSOI/0riVsaYiyxVCctnhb5+Ass9OAkwiMlyzvSQ2v/loWONveYkDKlTlg+eQZB0fE+TIt6Xfq3RIZmHEKCIbm+eIh4w86ys=
-
o37qblIaKvhOl4WxO2tbGMSJL3epj+S+EH8U3Z4txlZQAAAA0ZPSCFhkTkK8SuD61dcEUAmWAdWQUk/HNl+V3yvrxTNP2Iv963vaUJY5LlppoQBTAOy6R5Y3QlRjdrB78G1p6cRSJifagA796wn2+X5LUxwXFSqSVVaaoJz4jNqTLYPzb3EVBfCmQ+yl/2Ay+q9a8Zaa+LYGAq/8G1gQYYxF3cH8H4n29UtD4v6dSkBb+nht5uxEE5TOUZCCjxPNmRZ3cp+5D5999pNOqmwEE4BfOPI=
-
227UOeN0jf8v3pyIJEGeepqQbeISXpBoaX1t24a0leNQAAAAxw4ieqfKjhSAsL0tUSUuWZbARpaTvuaSCO8QFV/aak2k+LPEbOtbRLP5lEZrfj8Y7asYdr/rWYgB3eCratU2Cj98em3Amesb+tTOZPIH9tHRUSeGIFjFDpeZ8L+nXmo2RSaArUkT44OfBq3584tnNCQrz4tvZIFvahc7yhQb8Ec=
-
/eVieA5C86PG89MFwwhTLnz/UiWB0fWjc0p2FqD4HdFQAAAAfMyvFYCWy5HrhxRbQE1lBUcSpqc+y3ucqNx9VHZRC5yd4ndQpxUITRz287ceZa988T3LCa4yWOganmbhLl/YdxFN31u3N7d2EqW9ARW7jSBEFF7o68iyTRAVA3OIVTzvUIlVgDFWgk/gcN/enZRawTSdEe0HXqS21xRpyZ7pc5A=
-
clipboard
true
-
clipper
true
-
credit_cards
true
-
enable_ssl
true
-
keylogger
true
-
passwords
true
-
screenshot
true
-
smtp_enabled
true
Targets
-
- Target RFQ-JTSA 15938.bat
- Size 137KB
- SHA256 2bc1ad19e87a736fea30a5b5d83cde6517fe05bddb4f520a2ffe0c810d4a497e
- MD5 507412bc32d0dc8945eec91565fd0ea9
- SHA1 899fd6f54bbbc35dbd720236b366d733266ebda9
- SHA512 736931fd2aa92bf2579fbccd736fcb2f6d11b60a7073863727c44b80c0e32306845e386baece360126f5901cbf1ce60c8a1bbd68de25dfb72bc8ea20aec93b3d
- SSDEEP 3072:lN+K1Un3hh2mthCz4lA86QPVomQiccGQg6zs7Us/SuI6LZDN:e5nxUmK4WrcVomQQg6zkUspT
- TLSH T125D3023DDD9176488279939C30E5FD8213ABEBDA8B0FF498456C5A831FA0E4CB7C141A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Registers new Windows logon scripts automatically executed at logon.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext