Overview

overview

10

Static

static

1

SWIFT CONFIRMATION.js

windows10-2004-x64

10

SWIFT CONFIRMATION.js

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    14082026_1611_14082026_SWIFT CONFIRMATION.rar
  • Size 617KB
  • Sample260814-tm4jfaag37
  • SHA256 b6ecd6ddb139807d18cde4ab867405623e246be73800a70d11e9486a2ef82a2c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
phantom_stealercollectiondefense_evasiondiscoveryexecutionstealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    rrcindia.co.in
  • Port

    587
  • Username

    [email protected]
  • Password

    RRC@2030

Extracted

Family

  • phantom_stealer

Version

  • v4.0.0

Credentials
  • Protocol

    smtp
  • Host

    KXX9wohVxjCK4T7BUWLVZh5ca0bvmx4AA7t50sPFU8BQAAAAdEgVsjr3/jbV+yEKNRBYYHPuSeW57uwffF4OQ10i2KINyW151fJbQIta18rVAUW6PrtH88B8f1dUM86l36hudwPU8nxdYN//EtNMZ5WyJbwTy2RhrPqOeDOtUV/d3sL5
  • Username

    XyFzPbp4MiTfec0xo7KP9qRUHHUUodqjKt+tkoGPaRRQAAAAuEl47XQ38xPDnb2+splHwEtNxWdo7bWBQDhM+3cVDixZhOhckIO/3+53GKKSoUSBSmfNti74UXoCfsQwOOVgVmOSfo27r6lJ3GyGYRrwSW/Cd4UlC1bbEA3/OCbbc99pb4SIo4CvshO4vro+WXb0BQ==
  • Password

    IvlIwTNf8IR/wInzHLdxjujHSkFZhHB0/9VP8Zr0Y1VQAAAAGOewY3PkMo1cJBWvXeYv8vW69AEA8gxxfpo+ynU9oHKbNOPw5KitcIpXdhzu9KuSdWP4g3tynTalvJpNNxuwtk4joxwPWZzZeZE7Zv5qSQ0dMrGHJ6sHQMmuGtAic8yZ
  • Email to

    ig2U1AHLppvfqH55ll1ks8ykYD/fx23THSZef3su4QFQAAAAZgLCF32nJjE83ZCQPNwTIbIJqr4LYb4mq5jBFZyWvJGpgHhXlUeB2LeFOb0xz1beUuJoCDgywHkUWG78jPTC5I65WHHzZ/2aiI7vRmIHQxQ2nZ0HDXdXKuhjXrgIUeXnU9jAg7bUBPIw9IWCva5L6w==
Credentials
  • Protocol

    ftp
  • Host

    0
  • Username

    0
  • Password

    0
Mutex

  • 25Y71DU3K7OH0YIV8YD0

Wallets

  • 0

Attributes
  • clipboard

    true

  • passwords

    true

  • smtp_enabled

    true

Targets

    • Target
      SWIFT CONFIRMATION.js
    • Size 3.5MB
    • SHA256 f4886d0f0224515575e426b6dc60fc3ae27a3ceb0f8d7d31c7dab933959d4413
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondiscoveryexecutionphantom_stealerstealerdefense_evasion

    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

      stealerphantom_stealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Accesses Microsoft Outlook profiles

      collection

    • ConfuserEx .NET packer

      Detects ConfuserEx .NET packer.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks