Extracted

• • Target
    New Order.exe
  • Size 1.5MB
  • SHA256 70501144a459b9fdbc8b6e549fbc08db479b7d7aab4e02a352b3f11ba1ec686a
  • MD5 7ab123e9e6b30c85ce2432cd10a0c1c6
  • SHA1 497735f77995080e7d677b465b22c36c33ad6065
  • SHA512 1fff77ca89a814270a53ae80e321ec26dd7e41ae2eb570ecd35e05bf656c409a3259d424b24efacaa549a88774c7ed789b687d4f2b639ea79183c3b41585b298
  • SSDEEP 24576:+ZRSA2nk234DJ2R89RyGlqAhQS9DyIVPKNYul3t7rJ7CzfCx:20A2N3c3qGjhQ4y0jU3h972f
  • TLSH
    T1DA751299231EDF06D9A20BF49D70E7B41BF41D996A20D3179EFA7DEBB834B100845293
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2