MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89
SHA3-384 hash: a82f5af22cc6523d4dadb61c01d6b3daa80549083d09ad48f76326a8848d1af47eb5460299e2b3113ed5db0b30812bf9
SHA1 hash: 7adad0266e5301ff6caa2b774d271baf638e77f3
MD5 hash: 5dde11e44d06131109688e6375be6ba7
humanhash: freddie-washington-bluebird-batman
File name:420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'585'152 bytes
First seen:2026-06-08 08:49:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'011 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 49152:ZZLyYulNFwjhCivtkazKSGUSv3Xhfjmo3FQ:nulIlfvtFeF/xf9FQ
Threatray 270 similar samples on MalwareBazaar
TLSH T14E751245225ADD02D1E60FB459A1E2F027745E88E936D2478FE6BCEBBC7A7406C093C7
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe PhantomStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d1365b8b-3c62-48cb-bbce-e7298f24d626/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69667/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3571.674.25395.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2682633e9eff6a6b68b64d
Tags:
virus micro spam msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt packed
Link:
https://www.filescan.io/uploads/6a268217bf16337e43bb1344/reports/c1e26c43-5e79-4f48-bf54-62f00c2e5487/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-29T03:35:00Z UTC
Last seen:
2026-06-08T05:38:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/dae91e31-ff55-4868-b9ad-55859006dad6
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89/
Threat name:
ByteCode-MSIL.Trojan.PureLogStealer
Create hunting rule
Status:
Malicious
First seen:
2026-05-29 13:18:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
phantomstealer
Create hunting rule
Similar samples:
3fa18cc53e1e88e8c62db1e4b7202e9bd71fd90d019e02e2a5ab7e0992bdad41
PhantomStealer
420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89
PhantomStealer
8cc13d005f8d4017555599722e72e8984f3740282747598cf7159c8a398eab1d
PhantomStealer
91953ec60dacc96b02dd7e426bd5cdb4dc59b99ac540f8e8104e1783e8390817
PhantomStealer
error
PhantomStealer
f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff
PhantomStealer
+ 260 additional samples on MalwareBazaar
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260608-krelfaay6j/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Detects PhantomStealer written in C#
Family: PhantomStealer
Unpacked files
SH256 hash:
420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89
MD5 hash:
5dde11e44d06131109688e6375be6ba7
SHA1 hash:
7adad0266e5301ff6caa2b774d271baf638e77f3
Link:
https://www.unpac.me/results/0210cc07-76b7-49f5-905a-34987dac29ac/
SH256 hash:
441ce48895a3eb5bdd3b000bf71cc13a05ac0edf58670e2ff804c7d0f159be94
MD5 hash:
c66cbbcee2104ab9b0713c7cd8cbe949
SHA1 hash:
7ec1c45a45934c39a0267e096f7b1f3e7996051c
Link:
https://www.unpac.me/results/0210cc07-76b7-49f5-905a-34987dac29ac/
SH256 hash:
92c540aa9e4b579bd2c6a5b17f5b0adf31d63f367017cda95a94de539e65dd18
MD5 hash:
81a5ea8e0fcb9227996038fcce592723
SHA1 hash:
c157d08be226499a717d101bfbfa0d2a1e7c0662
Detections:
phantom_stealer
Create hunting rule
Link:
https://www.unpac.me/results/0210cc07-76b7-49f5-905a-34987dac29ac/
Parent samples :
1fe20f1ffd40e292837f4401f094e9d830874ae46f7a036ec66d5e720edf18a9
c5c29720693314c6492a45268a4852d5c6efb4698d928ac6f68c283ea7c9f785
5d23a0e4656f41bcb064307a614565b32cf6d04d6b38a910f24570907f29b436
db0864b36e22c383e8e59b8d2d4610276ab4bbd97d7b382bdb451fb7ed9a6540
420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89
d6168fea1d549e10df9f33d41a6058573f32312eb67b1cc48756dca2558479ca
7c26003b25a03f34ac2ddd11324d2501506ef7fa694cac3ec9d63717d3071783
e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425
863e5790dc76c8ef082144e1f7ed91e92cb72960172b56af593737c738cfc8f5
SH256 hash:
5aef543f2aaa09031143ed0b9734dd693fa81b56dfe75f546df36ea394210131
MD5 hash:
706cd7eac9f2ec43307b7b4538a39a95
SHA1 hash:
e31f3775922f260fc3ba943eb2f2770f7b3b1112
Link:
https://www.unpac.me/results/0210cc07-76b7-49f5-905a-34987dac29ac/
Malware family:
PhantomStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/420eaeab7871/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MoleBoxv20
Create hunting rule
Author:malware-lu
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69667/

Comments