phantom_stealer | 3c37189420cb81ca1b567be5fc4f2a0e4c9e9e39004778c64f96fd6c3e2f0ad8

General

Target
blastermaster new (infected).7z
Size 7.6MB
Sample261029-e8cwaaat3k
SHA256 3c37189420cb81ca1b567be5fc4f2a0e4c9e9e39004778c64f96fd6c3e2f0ad8
MD5 23c591b81289365ee5fc48b57df38a60
SHA1 331b0dd47f34c9e90077921ca7a24261b58c2d4c
SHA512 0307ad00362b404fadcafb66a6246ff6b71c6ddf78524c23cfebdeb638a0323139b857cb98cbae708f627c2dc78835aed9c985c7a3db0c1917c604ab1d221001
SSDEEP 196608:IITTtNF20PKcHBG8DWJK4YfnPR+35rgk+Ib4kBXYjy4yl:IITTtN8cfUNYXR+JMk+IQy4yl
TLSH
T1F486334B270B3978EBF6F0D0B23EFDD954A6AE121DB88467484F3A1541CFA2C21195BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phantom_stealer

Version

v2.0

C2

https://api.telegram.org/bot7572705839:AAGU_1U-jzA4O7OJa9YM5FON6rCuEaq_k3c/sendMessage?chat_id=7348580972

Mutex

A5HBKT1SFK5TPMSVA1WR

Attributes

anti_analysis
1
cb_enables_ssl
0
debug
0
keylogger
1
rb_discord
0
rb_smtp
0
rb_telegram
1
start_delay
0
startup
1
webcam_screenshot
1

Extracted

Family

quasar

Attributes

encryption_key
CD1329FC374DEEBE79332CB998E1560FF1C58C98
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  blastermaster new/StormKittyBuild.exe
- Size 366KB
- SHA256 f05670e2a46f81be69a66c759723e2940da5696bb529716940d1bde591d465d9
- MD5 5bc29568c71379d4554485782b049058
- SHA1 3392b1bae5d5ca39a3898d2ade75052cd58fe62a
- SHA512 2887bdcc0ede427c47e816a091c13746fba2f2d19bbeed7f8791f3d18f4ab56b38bab684bee117c00da12414a462d638f0c6f7aff12acc4f4518917552d953b0
- SSDEEP 6144:u4GLEJNR31jNb+f1wy9dA6S6V50IiCV1uCXD5k30ZgLA3zB0bPrx41h8glN:uFLKpNyj86gdCXD5M9AjmS1WC
- TLSH
  T19D84127CE6D8B7CEC6613138C9EE6F9D41F298B64807C5D7E82F63191C5466342482BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery stormkitty stealer
- Family: StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1
- Target
  blastermaster new/build.exe
- Size 7.0MB
- SHA256 fe1b5dad516dd7ce0563095b0a4eb2ff29ae26d6f571cfc6c1cadb5dbaf5590b
- MD5 1f43954b51cbbcedc1f548cf1838e58a
- SHA1 4f4c7354f582f0e4b3a3f988cc708b34e69a0462
- SHA512 4d8b202c1b0b0347688afcb55c821b49805a272ee41aad6a95ec3687b4bab5b07784530edcd5559f1aed2009f18896b61ee23eeff82101042be4110815242b30
- SSDEEP 196608:lMPuV25DeTD+oqzukSIlLtIY79n8SI75bWAXAkuujCPX9YG9he5GnQCAJKN:eA403qakSoR7tfI7ZtXADu8X9Y95GQLJ
- TLSH
  T13476334463EC0259F1BFAB78F87162119E32B513E53AE74D198C119C0A72B82EDA1F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution phantom_stealer stealer
- Detects PhantomStealer written in C#
- Family: PhantomStealer
  Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
  stealer phantom_stealer
behavioral2
- Target
  blastermaster new/buildd.exe
- Size 7.0MB
- SHA256 7c93f98d2e78615e5af7839bd84a311dad40fcec4474beb5fb37b501c91030a1
- MD5 496b6023a09fb3ca6430967554729766
- SHA1 e464a3fd634e8b4930bad4753d49733bbd8b9979
- SHA512 b44231abd3d19960be55fc4e761a3bfb8bc764b1f935bc11b4b58e680df8c0695e0904979d8250a07b2ba1a3a448cd4df6ca9283f5f964238ec75a45275f2fc9
- SSDEEP 196608:xMPuV25DeTD+oqzukSIlLtIY79n8SI75bWAXAkuujCPX9YG9he5GnQCAJKN:KA403qakSoR7tfI7ZtXADu8X9Y95GQLJ
- TLSH
  T14476334463EC0659F1BFAB78F87162119E32B513E43AE74D198C119C0A72B82EDA1F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution phantom_stealer stealer
- Detects PhantomStealer written in C#
- Family: PhantomStealer
  Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
  stealer phantom_stealer
behavioral3
- Target
  blastermaster new/crss (2).exe
- Size 952KB
- SHA256 e55f352c33ff90031bb2a2a45999c1ba2603efbd1420a28b821df377f79db097
- MD5 a5eed7182199838e204e2035ef5aab08
- SHA1 d9a5c20466e988a6ca577057a8c7e4a7617cbe4e
- SHA512 b6b032e1d99650f4682228d61bbbc55dd673c4675f02d4495a30cef2744ce56e55297f332f7a91161446b798175ea4021106d6d014c72f01738bf68bb1dba596
- SSDEEP 24576:sF/pvxJzck+uGW/yFoBkkAQWAmdzpYR3TTyq:sF/pvTYjqqanTWAJ3TW
- TLSH
  T16125C09173F4860BE1FF2774A4B249490BB7F9565976DB8F0D8890AD1EB37808E017A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution quasar module persistence rat spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- PulsaRAT library module
  Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
  rat module
- Quasar payload
- Executes dropped EXE
behavioral4