Extracted

• • Target
    8da2763b7ee25e8ecd2b448549f1381c15bfb934653472a09125869b6513cfb8.exe
  • Size 1.6MB
  • SHA256 8da2763b7ee25e8ecd2b448549f1381c15bfb934653472a09125869b6513cfb8
  • MD5 066d8236aa11fb7edf8a7610e8be0e6e
  • SHA1 6c63ef22c9e1563efa3caca099f42bf2915d22b8
  • SHA512 ca76b04cde6daedd408e894876841204824283af57403a7437cd60a2cc4f4731a88f07ad7fe4bb22c64497bc1d411682de8b35bc96d9e095527e880e717c05f9
  • SSDEEP 24576:1MqYjP/2oSdvgWQHXyYCLdWN7kNc13K7spyZMds7jCZOS6WPJIHJe2TnRVjf6gsE:Wb/2oS25HyWNzFYRSDIHJe2TDflsu
  • TLSH
    T13F75E0042126DD12D1E25AB0D8E0E2FF16745E83EA11F2439AE67D9FB536784FB846C3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2