Overview

overview

10

Static

static

1

ORDER RFQ 1180.vbs

windows10-2004-x64

10

ORDER RFQ 1180.vbs

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    25082026_1405_25082026_ORDER RFQ 1180.rar
  • Size 2.0MB
  • Sample260825-rd8exstbrg
  • SHA256 bcb20ef7dff4606479d5f3dab26cf70cde84b914e90d07e7a1cdc2b45b3db4e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
phantom_stealercollectiondefense_evasionexecutionstealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.insticod.es
  • Port

    587
  • Username

    [email protected]
  • Password

    Ho6!m3e2*

Extracted

Family

  • phantom_stealer

Version

  • v4.0.0

Credentials
  • Protocol

    smtp
  • Host

    9euGEDc2B+LnAXD2yCz/8HSkO2m1wfd9XRLi5/zO0hNQAAAAd7dtZWkSbk8eAuCGLwGCg7l9Zhx2A5c05ZuVP/FCS97hmp84cDRSFY67fg5vEVAxH/R9uRQWiVoiKMPB7/T2j5KNx2idLuMiEDM1ak4JQhHepyyq5zL2QH1tnpiVTs1MM3uxA+28E5E9pqHHTbb2kg==
  • Username

    cXUoC9zu7a87NJwale6pbu2qL4gp8JtkjWihcvo3EuVQAAAA7Cr7ak4EErI2uquEjmRiz/21N7IennsA81mdCDlCAMY4lreaDSNd0fCALsT7kdsj/xexZLQHB4xG2VY9PTuX10lhGfVgYn2ZZxx5DDFmxvz6jCaYWiW68tB6lNKrxem9SvVhHoax/d7+x3bbOKENNQ==
  • Password

    HrjBIiI9nmZtMgFwkgVvI+paGeNGupaagBe3MWKCP05QAAAAnZU86UTshei+5aIO9dYQIB7cCLhWlUk7axAEf21JKpbQMneXKntikKZKUFWY+H6/t3AA2TtsfWU/vqswbDMWkn4gyUwk7BbBq1Q/OwGgUsY7eAvlVO4NeMFCd46otxU5
  • Email to

    rvwHt7PitbclVQckiFpziKo+e12wAmzAUeSCuo4wy7ZQAAAAcaWXOUz7ZPfMXxBewPZjFlA4Uurumn87mute6jy1inpI4qsaW1zYq8D+jQO6u0RRVCVx8GgxjTgD2aDp+yLhZ9Vuh7cpejuHPT2nXHeDrDCAeLlfbIYv7ho/Blhh0MrQ5ck5F/l7MLztjul08raByw==
Credentials
  • Protocol

    ftp
  • Host

    0
  • Username

    0
  • Password

    0
Mutex

  • 0COHBQEGNLL02WSM5W1P

Wallets

  • IbmOLIk+wqxCEPaJPUiPbBhzJrFiULmh5QZj/91iQ95QAAAA7IoU3QZDCNNXfuPd6kaVJ5VrnhCkI/EFccrUDm7X2f/9t8iMwXUvvAkGHSTJRbrmpcJ5f/mN7YTn2qDSRTljWmwl9CwLKArfNYdzOaxpUzwRMBTYeXJ0ldfo5IuEit+URVEBfeIPRoJv9bNbNDGfkuz7OdH6m/yc4SfQB83lMPk=

  • GfCIx+o8E+8xU1/sU+b3PUHVwYHEp5f+lf25Q4kchzlQAAAAXh8RWXtJ2M1MMwAMuPHuHHLQ6xImiJYnURPzUkKV503x+c6hfJhNHCQR8ANzka/K2foHxAeGer3F7h2cpCedLPw8k2ELqeiXHFkF0YM2JVh5T/oWSdEkDJD5dFxhPy2FwkPl2t1HS5/NgmELMOf6+6ZiE06xinwYCLN4Tkyynn4=

  • 9/ZW1jfPVzkZj1+GCWLO4hOXXq85CajjR1dyGlJEyP1QAAAADH0Wx2LiHkOeOaCNeIKYj0yFa8Sj+NkAkuM649TekDYK1cXZo00RpDtJzI2pE0WwvBhsZ4bF9ka1XjHQerbQ0N7UROcNuwKrmMEKZpBXhqpGDnRklud6D6d7xreh9eaVTVD4FMsDBEYPCDyoDi5T2XqolgLcxf/DY2kk1sAxoxI=

  • 6V8886pFWVDhOMWV89KzA5JloB09viyjL6UM7FJo3CZQAAAAn583l0UNVKMP9K+pfTgTLKJgwQ+TZoU9O32mUPx43OVtISBs6eDTkWIujw198F+kVq8yudoOP7KaT0BfvFJVFJmdaGksOpJeGEW5sg3Kq+1AYkYLBFJ4G2l5bay5ngMTauFSAnc9I6eWUIfrgXZQDvMkq3fnxUDSbQn7mkA6sFE=

  • 93hf58f50oSnY98pkjoLQmFoZJShvoAMS9wn/dbpZ6JQAAAAVGvkuTEOVyy8tXbCcP9y+ZngHLAArmYZp/2pW9V/bwQddyE+p5J0nIn0/u0v/I2mv32iQdV7o8ZgDUgupIGPKHde+S+qInmLVXatl64ZKMcdSbEdVH9SpiCjNc06wjAkoTshoxJrU85p5j7qAbf3zjy9tIBF0elIjfuq7vAZ3C0=

Attributes
  • clipper

    true

  • enable_ssl

    true

  • passwords

    true

  • smtp_enabled

    true

Targets

    • Target
      ORDER RFQ 1180.vbs
    • Size 2.7MB
    • SHA256 0b4cc8d0fdd4c4569285a0b89d5101ca717d9f8c6ee01d230ea59683682c13be
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondefense_evasionexecutionphantom_stealerstealer

    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

      stealerphantom_stealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Executes a VBScript file via the Windows Script Host.

      execution

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks