MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 189e7289fecdf6099e9b1dd6d4dfa409f482718a0a3bcef45afa7f7c3ad5ba98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	189e7289fecdf6099e9b1dd6d4dfa409f482718a0a3bcef45afa7f7c3ad5ba98
SHA3-384 hash:	84ebd3da17cab6f595867b6c75edfefe5b24a033c695f8be3d33dd8c618608abcb7aec1f759fa79d284a8d1f44f1b5b8
SHA1 hash:	2a8947f607bf0c42f0dc64a5394d4f9f6ac04569
MD5 hash:	301a89fd97c02b78e982578bdfc919b9
humanhash:	pluto-item-massachusetts-jupiter
File name:	RFQ _ SK PREMIER - PR-SKPREMIER-20260724-066D - SPARE PARTS AND ACCESSORIES.js
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	2'552'183 bytes
First seen:	2026-07-24 05:34:38 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:2RVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVRVt:O3
TLSH	T1EEC5112D6DF684E03C6B37AE9C4A39E67DD43E4ECBA28C851F7065C63086D0C4A16E35
Magika	javascript
Reporter	lowmal3
Tags:	js PhantomStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

160

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10514.29651.19259.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fingerprint powershell repaired

Link:

https://www.filescan.io/uploads/6a62f9ac11414033a33b1f40/reports/408b51e4-7d6a-4e5f-b7b8-97e0172e0fbb/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/189e7289fecdf6099e9b1dd6d4dfa409f482718a0a3bcef45afa7f7c3ad5ba98

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-23T23:53:00Z UTC

Last seen:

2026-07-26T02:18:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/189e7289fecdf6099e9b1dd6d4dfa409f482718a0a3bcef45afa7f7c3ad5ba98/results?tab=lookup

Joe Sandbox KeyLogger, Phantom stealer

Result

Threat name:

KeyLogger, Phantom stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1947471

Signature

Antivirus detection for URL or domain

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Costura Assembly Loader

Yara detected Keylogger Generic

Yara detected Phantom stealer

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

56%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/189e7289fecdf6099e9b1dd6d4dfa409f482718a0a3bcef45afa7f7c3ad5ba98

Malva.RE

Gathering data

CERT.PL MWDB phantomstealer

Detection:

phantomstealer

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/189e7289fecdf6099e9b1dd6d4dfa409f482718a0a3bcef45afa7f7c3ad5ba98/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-24 05:35:51 UTC

File Type:

Binary

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dcphfcp6zx3athu3dxlnjx5ebh2ie4mkbi5455c27j7xyowvxkma._file

Threatray PhantomStealer

Verdict:

malicious

Label(s):

PhantomStealer

Alert

Create hunting rule

Link:

https://reports.threatray.com/9e9d0862-03a9-4afa-9563-827d519b60d2

Similar samples:

19269ce86552c69219751cde2cd3cedcaeb2ac7474a2d279f024352972ac69e3

PhantomStealer

2a86c8ae8cabbeb5909a0240fef9bd50fbf422f9d3d6a54c4a4e5c255dae3ddf

PhantomStealer

6314c3c82acb165b93aa922ff379754ea29c321d7a757a5d55d72e537072d9c7

PhantomStealer

92dcc781743e20dfd4cf110d93c16298f5d957150cddd0cd6f331a600783366d

PhantomStealer

bf5f373bfd33cfaed340126646090dc87e291f5bc7d33aa31b9aeb7b968fe7fa

PhantomStealer

f09a097b958bc565b990c17bb42765b488386fc2803a41872296db6923f09c32

PhantomStealer

Hatching Triage phantom_stealer

Result

Malware family:

phantom_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:phantom_stealer collection discovery execution stealer

Link:

https://tria.ge/reports/260724-gactqsgp2x/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Badlisted process makes network request

Detects PhantomStealer written in C#

Family: PhantomStealer

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/189e7289fecdf6099e9b1dd6d4dfa409f482718a0a3bcef45afa7f7c3ad5ba98