Overview

overview

10

Static

static

10

05aa847cdf...a9.exe

windows10-2004-x64

10

05aa847cdf...a9.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    25705100190.zip
  • Size 144KB
  • Sample260820-e8xkpaen4z
  • SHA256 2cc60bd43d61463f2b51dd7462d337f63cfdd233995417264a0c40ea8ec6ef52
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
phantom_stealercollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

  • phantom_stealer

Version

  • v4.0.0

Credentials
Mutex

  • Z4VW5W7ZIP76VJF0VZXB

Wallets

  • bc1qq8zs0ngk6t0ergwdknpc9m4e46pgnnns47h9er

  • 0x7e3205A62FCf14a1d50aA7A58B6aE7daC471Ae9e

  • LaGNPik4pQrsipv6tXm8YCaMn3T6ZmcHyt

  • qq0zxsskgel7vurzqyzdkmepwjunp5vwgvvdlvudkv

  • 47NagK8jt1U6UoTzU7mFXPghQbodptiyBZB7MVkxZFyYXpUfJqHAFUR71TH6pTZub13zZS8hz4M6YTuytGwpefVTT8sS1Bc

  • TDLVU9c84owCjrKCiHXK27zdLefnM5g941

  • B7VfhomCgQXkWeLXKUB7MVrDA7iRHQ5rRMwZ2swad8pL

Attributes
  • clipper

    true

  • enable_ssl

    true

  • keylogger

    true

  • passwords

    true

  • screenshot

    true

  • smtp_enabled

    true

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.trimnt.com
  • Port

    587
  • Username

    [email protected]
  • Password

    her6+eMmNJbim&[F

Targets

    • Target
      05aa847cdfc69a78282789291a864d335bf003da87479d6a7673c1068c9905a9
    • Size 390KB
    • SHA256 05aa847cdfc69a78282789291a864d335bf003da87479d6a7673c1068c9905a9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondiscoveryphantom_stealerspywarestealer

    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

      stealerphantom_stealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks