Extracted

• • Target
    MBL instructions.exe
  • Size 1.6MB
  • SHA256 41652e0a1f50751190f05a41462c466593813c6705b6fd60343df28ed0650d27
  • MD5 d3aa814a94920e4bf4f4fa2d8c1480c1
  • SHA1 a15e32d15310c9799b684bfe9a625e1fd3eff5c7
  • SHA512 05ca57307b3e6cee66b19cab415189fbc646c240ee56fd8682e6c04f89fac2e9540ec67b36e7a63e9f5b87fae3c7dcc1dc1dbedcd002c16b36442fc9958a66c0
  • SSDEEP 24576:S7Q77uyf9/MmFnKyZPVElGAUpNGqpoNUaWbC2jewcNcaVqJUQGRHR:p0mAuPiIPG2DPe2jJuqJUQkH
  • TLSH
    T16575F1142217DB33C5562BB5D9B3E2F512A01E44E812D23F99E93EB77F36F781948282
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2