Extracted

• • Target
    APAYDIN METAL- TEKLİF NO PRQ26090060 Satın Alma Teklif İsteği.exe
  • Size 1.2MB
  • SHA256 9b24eede0b83fe9b4039b311d161a5e49d0981ac6caf867bdfb0e685ccfe84ed
  • MD5 ebb80273474c044c92cb0815fc0ea42f
  • SHA1 d448204b2f27a96eb1de102fc8ff4b688ce68c8f
  • SHA512 717d343457fd2574640c64d473485c0171f9e2db579611a4e370d08c6b21f52331d1f77cdd2e04bee035f0d44768c5004782f5228547254939bf3c03e9b4a939
  • SSDEEP 24576:TkLqwb7XFh9jExVjUlVzJe9XbZ1npzKU5DZM1Ocqj0qdP:TkuuL9jaV49exPnp+SOi
  • TLSH
    T1724512A86A26D103D855ABB84A71F6B8177D1EEE6911D3134FE97EFB7A32F041D00243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2