MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e
SHA3-384 hash: 65e656d13372d3dd102a6ef738c7cdf25d609249ea7558cd37505f1907de67462c3b9547c2a3d0e25024a806b710c6ea
SHA1 hash: 8d5f16ba4bf9c88c02686d68ff285a8dcd039c19
MD5 hash: 7d2462faf57eb68faca085d0e30985c2
humanhash: utah-pip-earth-snake
File name:ESG-PO-000433.js
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:4'561'631 bytes
First seen:2026-02-25 13:50:04 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:bWAONQACgOw0cWFWlaMWQI9OY3Kr5irymCM6DCYk6cP93LPLBtn6vXcAMk5amZAS:RtcA3xtL616FC42qBNq6HgZjX/
Threatray 390 similar samples on MalwareBazaar
TLSH T13926C0C79BA86FC17F99956860FE0F2F9EB44248913DB6E02372BE375AF3144520B065
Magika javascript
Reporter James_inthe_box
Tags:exe js PhantomStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Other.Malware-gen.66746142.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=699efe2fc950ab5d9ab18352
Tags:
keylog sage word
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated repaired
Link:
https://www.filescan.io/uploads/699efe1d91ad9169e5340097/reports/eb1e9137-3a1f-476f-9ca3-3aca68774d41/overview
Verdict:
Suspicious
Labled as:
JS/Agent.DRD
Link:
https://www.hybrid-analysis.com/sample/408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e
Verdict:
Malicious
File Type:
js
Detections:
PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Stealerium.sb Trojan.MSIL.DOTHETUK.sb Backdoor.Win32.Androm.sb Trojan-PSW.MSIL.Discord.sb Trojan-Dropper.Win32.Injector.sb Trojan.Win32.Vimditator.sb Trojan.Win32.InjectorNetT.s Trojan.PowerShell.Cobalt.sb Trojan-PSW.Win32.Stelega.sb Trojan-PSW.Win32.Disco.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e/results?tab=lookup
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e/
Verdict:
Malicious
Threat:
Family.PHANTOM_STEALER
Link:
https://tip.neiki.dev/file/408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e
Threat name:
Script.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-02-25 06:19:43 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ich376ztbljitluohg6xbcr4zw2vvqytldkkqlgouty4objqrqxa._file
Verdict:
malicious
Label(s):
fantomcrypt
Create hunting rule
phantomstealer
Create hunting rule
Similar samples:
2a86c8ae8cabbeb5909a0240fef9bd50fbf422f9d3d6a54c4a4e5c255dae3ddf
PhantomStealer
3c23073583bd33a068be551134983e7958884cb7656a4da03d9cc737b262f1ee
PhantomStealer
4a34e6614acd4a138eb1f308c21be91a8f0c53f00c307a1a5cf2a178182b62c4
PhantomStealer
6314c3c82acb165b93aa922ff379754ea29c321d7a757a5d55d72e537072d9c7
PhantomStealer
7b0832e2efc2f1882ee21569a8e051e8558ff73128275c072167c8abb21df43a
PhantomStealer
8b0fe67d4862db19d8af42c46986e6ff1750aa4eb04e2645aacf9b5a1416e84a
PhantomStealer
c0b1fa407b6f1c7a2c0636febc35adf5494f887dd5001be9bd5fab0870ad2ecd
PhantomStealer
error
PhantomStealer
fc3d9f89cc5a6b2824022593ed3ab4d94a72f71ef5f34953acc952141ad110f0
PhantomStealer
+ 380 additional samples on MalwareBazaar
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection defense_evasion discovery execution persistence stealer
Link:
https://tria.ge/reports/260225-q5gkvaht5e/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detects PhantomStealer payload
PhantomStealer
Phantom_stealer family
Malware Config
C2 Extraction:
https://api.telegram.org/bot6184405374:AAHQAJkn-lfcse6BcyJC7uamCzTrVOG0e_8/sendMessage?chat_id=1325336329
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments