Overview

overview

10

Static

static

1

Vessel Details.js

windows10-2004-x64

10

Vessel Details.js

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Vessel Details.js
  • Size 3.5MB
  • Sample260812-j741lascma
  • SHA256 668c025faee701ad9abb9493f9764c7f322c6a8ea1bc099a418ff5a721d07607
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
phantom_stealercollectiondefense_evasiondiscoveryexecutionstealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    plazamassima.com
  • Port

    587
  • Username

    [email protected]
  • Password

    Mortimer_2223

Extracted

Family

  • phantom_stealer

Version

  • v4.0.0

Credentials
  • Protocol

    smtp
  • Host

    c5CMXtPdO/leTFZ6/xSIUAx3lvaZercUQRB5gVAIcK9QAAAAojOiC8CG5Myz9nqKSEYc9kCIT7rRCHh5CFkSUo6k+V7h+yl5NBrdik/0CrsOMFdWbwOIb3zX7w3MgqCVespCFW6MjrCD0YYs7AgTi8h9sSxbPCXLvuhqflmiFD/MqAFWNT6814qnl7i4nTXifTObjw==
  • Username

    WVOFbwbTOxbdX4DsX4KEfZVU3qGtIRJ91q83QKyglj9QAAAAw/uerh+0FEKsyT1axV6RpTBTwxNo90qetaxFsa+eVBNj4eEsaJcnFnx5P2AkxNOA1JmKoj94hgvuFRxV18VegvDhPo1k/PcZ+jzsN2V3JAIKDeOWtRM+C0TJpwq39B4PV3G2YHQhMWztJZ6NMgeVCw==
  • Password

    ySLD5vfSAV0UH1wTpJ6It7oOqj5cT3c/XU2rQy5rkkNQAAAAOX1+vNVe9lZpAXxJcxk8869ppmkQp1eJppDn4e8rZrWb0h3K841oGYoju6Do8BH+Erv0YW/whdwSG5ECCCb1/NjWxhcrcit5C5GLYSMdZWW1ZKI97uA8ysaldGxdb8mj
  • Email to

    LWmW4j9vOzR++lfTpB1hHLzQlzSyYNFxxqmUjb2O6lVQAAAASFlmBsb+M2uaW+ZaESpsXUHhO1yNZZziG3o0pvGLLmnOqQZlEIJdsfX+lM/NmCT76nP6+JWF8+HnbvTqcgtU9Tee8YeimxAmlOInQKbykcacE5X41ObaffdHObohAmKcG1YM+C58358db5Kk8HBL5w==
Credentials
  • Protocol

    ftp
  • Host

    0
  • Username

    0
  • Password

    0
Mutex

  • 6AYG0D43T40OGLPMNUTQ

Wallets

  • 0

Attributes
  • clipboard

    true

  • passwords

    true

  • smtp_enabled

    true

Targets

    • Target
      Vessel Details.js
    • Size 3.5MB
    • SHA256 668c025faee701ad9abb9493f9764c7f322c6a8ea1bc099a418ff5a721d07607
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondiscoveryexecutionphantom_stealerstealerdefense_evasion

    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

      stealerphantom_stealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Accesses Microsoft Outlook profiles

      collection

    • ConfuserEx .NET packer

      Detects ConfuserEx .NET packer.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks