Extracted

• • Target
    fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9.exe
  • Size 1.6MB
  • SHA256 fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
  • MD5 59f94c914a02913c034de99447c86b52
  • SHA1 9cee61773e655e93cd4d0082f5007fa6b2e8f63e
  • SHA512 3ae6989b056cdb6d3e77c688e39b9c14d4e58f53faec17d85c4f7b4ed61f31774d4aad19bb06f063cebff6538bb87345721338a3d28886b92ae2f740316d2a8d
  • SSDEEP 49152:6b/2oSV+dICgRRHoCS3D9ipGaR5CiuUtOtZzMG:6buoKCgPBg5ipGaXC7Zz
  • TLSH
    T1E575125822A5EE02D2E26BF41C20F3B857B91E497922E3078EF5ADDFB5396443D452C3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2