MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d181f5e6c6902c71623eb9ed0553286bc168dc57d4c76b23e76bc8264316374. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PhantomStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 13 File information Comments

SHA256 hash:	1d181f5e6c6902c71623eb9ed0553286bc168dc57d4c76b23e76bc8264316374
SHA3-384 hash:	b9df834991a4d4c0e6094964aabac9854fc254069de3bd1ac28b7ba310d9dbcfd1404c1c8bd2d6b09a643674e3d4e3d7
SHA1 hash:	35c1bbf54a439d25eefa9024518a1876968f3705
MD5 hash:	699faff041697117f10c2d68813b9b82
humanhash:	mars-kilo-blossom-don
File name:	NEW PO SMART CHINA.7z
Download:	download sample
Signature	PhantomStealer Create hunting rule
File size:	1'522'912 bytes
First seen:	2025-09-16 10:18:14 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	24576:zvSDfhDQBYSpDafDpVLWx+Bjwg8/6aPZvwNxLLKWGvvY0NidCG6yqNJcCAEWHT:2DxqJpIDpZnBjwgG6q6LLKffNiPx+rAJ
TLSH	T1F86533DF99E4DD6E562AC3188352200446869CB35A7CF7DC3CABEF1B02BA91711A5F1C
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	cocaman
Tags:	7z PhantomStealer

cocaman

Malicious email (T1566.001)
From: "Nhung Le <nhung.le@green-signal.com>" (likely spoofed)
Received: "from 216-131-78-250.dal.as62651.net (216-131-78-250.dal.as62651.net [216.131.78.250]) "
Date: "15 Sep 2025 06:58:05 -0700"
Subject: "BOGNER 254SMS_ NEW PO : SMART CHINA"
Attachment: "NEW PO SMART CHINA.7z"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	NEW PO SMART CHINA.exe
File size:	2'770'432 bytes
SHA256 hash:	2a1dbc0ffe84cdcbbfcf573609b9313cd3235ebabe66adf707c12d8b97d83568
MD5 hash:	a0d6cee5bbb56e8975314415d5e3e370
MIME type:	application/x-dosexec
Signature	PhantomStealer

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.66333411.UNOFFICIAL

Sanesecurity.Malware.25544.7zHeur.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68c93984d49ea3f1e4b65e87

Tags:

n/a

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/1d181f5e6c6902c71623eb9ed0553286bc168dc57d4c76b23e76bc8264316374/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 crypto fingerprint microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/68c9398873287948292bb0f3/reports/f6b71a0c-7fc5-4997-a6a5-e9fc61dd232d/overview

Verdict:

Suspicious

Labled as:

Mal/Drod7zip

Link:

https://www.hybrid-analysis.com/sample/1d181f5e6c6902c71623eb9ed0553286bc168dc57d4c76b23e76bc8264316374

Verdict:

Malicious

File Type:

First seen:

2025-09-15T01:08:00Z UTC

Last seen:

2025-09-15T01:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/1d181f5e6c6902c71623eb9ed0553286bc168dc57d4c76b23e76bc8264316374/results?tab=lookup

Score:

98%

Verdict:

Malware

File Type:

Result

Malware family:

phantomstealer

Score:

10/10

Tags:

family:phantomstealer defense_evasion discovery

Link:

https://tria.ge/reports/250916-nsgc7stkw7/

Behaviour

Delays execution with timeout.exe

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Phantomstealer family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1d181f5e6c6902c71623eb9ed0553286bc168dc57d4c76b23e76bc8264316374

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)