Overview

overview

10

Static

static

1

RFQ 33418 -models.js

windows10-2004-x64

10

RFQ 33418 -models.js

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c58d501352af380de7ee4fbd39df6c6d58d29a27f0834d64402f6e8ada71d389
  • Size 593KB
  • Sample260825-csjmsaff83
  • SHA256 c58d501352af380de7ee4fbd39df6c6d58d29a27f0834d64402f6e8ada71d389
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
phantom_stealercollectiondefense_evasiondiscoveryexecutionpersistencestealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.gpi.com.eg
  • Port

    587
  • Username

    [email protected]
  • Password

    GizaPower@321

Extracted

Family

  • phantom_stealer

Version

  • v4.0.0

Credentials
  • Protocol

    smtp
  • Host

    PlRSZn+NC6yheiMZeVVf98agDqiPVtXFI8GmSS2m3K9QAAAAGeuLI9NMc7O9IHESBjLvO6Y7qdxpROcGm8Zx+cWNBQXRZYhzFOidjxSp3Wn5Tbd/yf4ZlE/YwL8qAkWOaUb32idu8q/n8cw6gwHTwsXQvUhojGX2OSioIxFmCencVil/
  • Username

    SWHSeYk9wOMRzxoLSFCyo0vEtCpR1L+0GZT9bdlymBFQAAAAnvFKHuJqWgeev8XkH4wsIJT2z7svx+OFc2GtSp2qCfmdAXxjkHliz0VpDSe70Fb1MyT7cVdEKdOuCutFiLT/d20GfpNnDPT2XutMmsmxKbzOnRMqv/0x1bcD9C5pR3gE
  • Password

    NmfmMpbJy7c5baTjtD3yt1AsV+ESTeNVO68oSIytftVQAAAA6Dpxnt9xEvcBtIamUQN8ux7olujR2PJ9pvZE/Y5LOm03IjPTWic43QpU/1v+KtkRORNZsWk8JeSX/Du7gZyh9+CMWTfW1D6eqxnEtc1mAoXkZ20CdEJyNciW0wj9Urj0
  • Email to

    mjoMjIUlCPar2Nw0a6IUIFV7omw2ZovRRR0PfJzlFvxQAAAAmgJMGtdI77VAOwX4GXxku5gzJiJaOVOFthCx5g5H04NsGTfiQxLphgXXnx9A0aq7niwxTBjPvLQdtfMQRspI6Nfffzq2duAiK2NdiIRM24EhwmMVm5wjx1Q5Vxpyc1waTx0sW/qK6nlRXG30EG2gig==
Credentials
  • Protocol

    ftp
  • Host

    0
  • Username

    0
  • Password

    0
Mutex

  • 6KOU7Z56D0O8MCHV7FX6

Wallets

  • 0

Attributes
  • cookies

    true

  • enable_ssl

    true

  • keylogger

    true

  • passwords

    true

  • smtp_enabled

    true

Targets

    • Target
      RFQ 33418 -models.js
    • Size 830KB
    • SHA256 ebe55ff8fe1a36f2101dcf651a5941432575ca645200768288f30dafe0f2c57f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondefense_evasiondiscoveryexecutionphantom_stealerpersistencestealer

    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

      stealerphantom_stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks