MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05ae50840a1027c6086daf415722121f7a260ccb4c3609cb049f5c8a2154187f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PhantomStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 28 File information Comments

SHA256 hash:	05ae50840a1027c6086daf415722121f7a260ccb4c3609cb049f5c8a2154187f
SHA3-384 hash:	de827df2a31bf16a087858efb508e8a58cdcd8ff532696bb5b3d80337bf8507f514952c76582450a982cc1daf55ba107
SHA1 hash:	a734a805abf76aced10e41d9a130564ebe1e9449
MD5 hash:	131185c401587a6279aba78da3ee7ccb
humanhash:	mars-whiskey-cat-hotel
File name:	05ae50840a1027c6086daf415722121f7a260ccb4c3609cb049f5c8a2154187f.rar
Download:	download sample
Signature	PhantomStealer Create hunting rule
File size:	127'158 bytes
First seen:	2026-07-21 06:26:32 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	3072:ijz1w0ntrGwd9lzJW8zDQPrG5YOmGt5bg:iX1w0n8E9lzHzcPrGCet5M
TLSH	T138C312DED09B05693DFA2B6DBD818C1BA16705DD6B6AB237132D18C38C6D943F8C7428
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	JAMESWT_WT
Tags:	PhantomStealer rar tourtrade-shop xtudsq--tourtrade-shop

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	raw file.exe
File size:	399'360 bytes
SHA256 hash:	801906d53d973d68367754281a9aba78bbd0de99b35bfa34f63baafa49eb179a
MD5 hash:	06a2e8ed1093aa0d0e10e68ed870d0b1
MIME type:	application/x-dosexec
Signature	PhantomStealer

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/118f2615-7fcf-4e15-a278-1716dc4b00cf/

Detection(s):

YARA.COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5f113e85479d70bfb78e8f

Tags:

emotet spam

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm asyncrat base64 cmd evasive explorer fingerprint hacktool lolbin lummastealer obfuscated reconnaissance redlinestealer regasm stealer wscript

Link:

https://www.filescan.io/uploads/6a5f113661a5b80433e45f6d/reports/8e1b3ebc-45ee-4568-8ac7-58421ee1d305/overview

Verdict:

Suspicious

Labled as:

Trojan.Agent

Link:

https://www.hybrid-analysis.com/sample/05ae50840a1027c6086daf415722121f7a260ccb4c3609cb049f5c8a2154187f

Verdict:

Malicious

File Type:

rar

First seen:

2026-07-09T22:06:00Z UTC

Last seen:

2026-07-22T18:29:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/05ae50840a1027c6086daf415722121f7a260ccb4c3609cb049f5c8a2154187f/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout Rar Archive SOS: 0.29

Link:

https://app.malva.re/file/131185c401587a6279aba78da3ee7ccb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/05ae50840a1027c6086daf415722121f7a260ccb4c3609cb049f5c8a2154187f/

Threat name:

Win32.Trojan.Sonbokli

Status:

Malicious

First seen:

2026-07-21 06:27:55 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=awxfbbakcat4mcdnv5avoiqsd55cmdgljq3atsyet5oiuikudb7q._file

Result

Malware family:

phantom_stealer

Score:

10/10

Tags:

family:phantom_stealer collection spyware stealer

Link:

https://tria.ge/reports/260721-hfkbfaaw9t/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of web browsers

Family: PhantomStealer

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/05ae50840a1027c6086daf415722121f7a260ccb4c3609cb049f5c8a2154187f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM names

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM usernames

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	malware_PhantomStealer Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	phantom stealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_NET_Shellcode_Loader_Indicators_Jan24 Create hunting rule
Author:	Jonathan Peters
Description:	Detects indicators of shellcode loaders in .NET binaries
Reference:	https://github.com/Workingdaturah/Payload-Generator/tree/main

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TelegramAPIMalware_PowerShell_EXE Create hunting rule
Author:	@polygonben
Description:	Hunting for pwsh malware using Telegram for C2

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	win32_dotnet_loader Create hunting rule
Author:	Reedus0
Description:	Rule for detecting .NET loader malware

Rule name:	win_rat_generic Create hunting rule
Author:	Reedus0
Description:	Rule for detecting generic RAT malware

Rule name:	win_stealer_generic Create hunting rule
Author:	Reedus0
Description:	Rule for detecting generic stealer malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample