Extracted

• • Target
    70709ba747aa5f89277fbf2c80fd0c02975c57996cd11d323427e784faf53d68.exe
  • Size 1.5MB
  • SHA256 70709ba747aa5f89277fbf2c80fd0c02975c57996cd11d323427e784faf53d68
  • MD5 c9e707b4085ea268506f1c7ea8ca57b5
  • SHA1 c98e2345a473cd6e930eba5905013f826031e4b7
  • SHA512 f3df5d14d5ef5b8968bf99a66dfc1063f9a0d0cd1076c28c5855a0d16f8218801091fdc38d4b56b51e6d9e476af413f732d7c5fd0ba4f8c1e879da2e555f5dfc
  • SSDEEP 24576:GBnn+0Stes+Ap806Tfjh1glVPaxtMHnhMgP905vaERAGtQg2:0hPGoTfjh1QRaXohMH/x
  • TLSH
    T1E475DFDD7204A58FC9A38A31DAA4DEB04B206C7A5306C20390F73DABBF4D597DD056E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2