Overview

overview

10

Static

static

1

FedEx23476257282.js

windows10-2004-x64

10

FedEx23476257282.js

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    15102026_0925_14102026_FedEx23476257282.rar
  • Size 2.0MB
  • Sample261015-ld38baaw5v
  • SHA256 96daeba995a3f2d1cb7a9e4a2b5fd56293bc3025adc4b12df4ea235a52d102b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
phantom_stealercollectioncosturadefense_evasiondiscoveryexecutionpackerspywarestealer

Malware Config

Extracted

Credentials

Extracted

Family

  • phantom_stealer

Version

  • v3.5.0

Credentials
Mutex

  • K5O7W2WEMSJKN2ZT85XY

Attributes
  • anti_analysis

    0

  • cb_enables_ssl

    1

  • debug

    0

  • ftp_enabled

    0

  • keylogger

    0

  • start_delay

    0

  • startup

    0

Targets

    • Target
      FedEx23476257282.JS
    • Size 5.0MB
    • SHA256 d97f6bc775e3b4a1fdf05ceafc42e9f72261ad0b7fbde39f2782c97f68142941
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectioncosturadefense_evasiondiscoveryexecutionphantom_stealerpackerspywarestealer

    • Detects PhantomStealer written in C#

    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

      stealerphantom_stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks