Overview

overview

10

Static

static

1

e40c6a6b-c...fa.eml

windows10-2004-x64

3

e40c6a6b-c...fa.eml

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e40c6a6b-c469-dd92-6da9-ac8dc00969fa.eml
  • Size 2.0MB
  • Sample260817-qx9xescl6s
  • SHA256 44d0ff9a1696675c05a8262ce694365cec77485a46ce99d753654b641a0be5a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
donutloaderphantom_stealeradwarecollectiondiscoveryexecutionloaderpersistencespywarestealer

Malware Config

Extracted

Family

  • phantom_stealer

Version

  • v4.0.0

Credentials
  • Protocol

    smtp
  • Host

    vOxe/76pF7SGqHX/HEsX0rjwLa8y2mSVHhAA41odOopQAAAA1CKNHc5+Yu3IcKcq7pN1yBhqifu53OYUUnutURVb+oDecueCbWVkThFPg1zpKNgUTN9yPKW8qTU7tmIfoCDJ4uqtLnocvmjjbBDwtfhuVukaZ1xKCafsMKnXdhaqo+IW
  • Username

    CyA9nrYk7hwHTYFgu6/N3vyW+MRFLecDmdXcLhSS8t5QAAAARhdNT393fH6Iitd3D49PIJspkW9f1g1AQECYA7rzEo9qzO02MMgoan4O4C7GAODC0hs3eM7IWQCWrv9RfX22soh124G7NkwbFKus9AIvnXd1rIUWLybtMamSJ2DbkcphareM8stMOw+Vks8HQYJOzQ==
  • Password

    Kmf6pk9fAseAAVjy4GgVxGZPuGLK2BID5NNroOvBWnNQAAAAUMfq2BsoU56qsKbv+jwuUWPCgSoWHRZ2YFwoHQYs9CQmh6ekVPHS2n3ZzVlqpB88LkV0GhHhCquQ3F5YfxBofHGzx4d4ur9oL8lZYXB4UOjL5Do4b6iUNHP4lWyqXgn3+bDYlaTzn+84Ht1NWGVdbg==
  • Email to

    5vZYzz1BmSmcuQk08f3C0yR4yB2zEem6r+uDiiGurXxQAAAAxltz6vvcN6RjuJZuvJ96XDfliovNPWes2oYggMXaqZ8lAEWT03t0J6OX5bk3BwJnSYiT890rX9Rvh4NaTF3ctOwzepqCY++mrHQpG1Y74lPtYcEid0zFxaI3lirzmc6l4HywuZ1s6ZwlAAtJBHhHFQ==
Credentials
  • Protocol

    ftp
  • Host

    0
  • Username

    0
  • Password

    0
Mutex

  • M9Y7LQ9X8ELU1GNS2CES

Wallets

  • 0

Attributes
  • enable_ssl

    true

  • passwords

    true

  • smtp_enabled

    true

Targets

    • Target
      e40c6a6b-c469-dd92-6da9-ac8dc00969fa.eml
    • Size 2.0MB
    • SHA256 44d0ff9a1696675c05a8262ce694365cec77485a46ce99d753654b641a0be5a0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    adwarediscoveryspywarecollectionexecutiondonutloaderphantom_stealerloaderpersistencestealer

    • Detects DonutLoader

      loader

    • Family: DonutLoader

      DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

      loaderdonutloader

    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

      stealerphantom_stealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks