Extracted

Extracted

• • Target
    KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
  • Size 1.2MB
  • SHA256 b3217ca3543005ea9d318cda4abdc79af8079d9e1cd60c38e9c042bd8c0b6469
  • MD5 ff9f3795b98a500d318432e023a71266
  • SHA1 34eb9005ed730e136558e39e78c96b6a9b746bd0
  • SHA512 38a738003edc563ff5e268c8ad1dd058ae28c8f668dc6664db1db28255e196d7df059d24aa8932167588495cb143287064783872e56fcbef11422e5149cd4e44
  • SSDEEP 24576:Kx6/BQAV9DTP9WQPHyNo8iZIxfOfEg/RJ6gLsyfA9:peAbc0WoTtfEgJDLBi
  • TLSH
    T1BE5512147678E727C9AA97F91A71E63907F99D4DA020D3164FE4ECF77D22F0128242A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2