MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
SHA3-384 hash: bdefc48de19d4442ca2a055065374b9211acb818466c9a31045211b9538a36826b065c8c9eb0b791d5e82d5c2ca859f1
SHA1 hash: c9255df5ef638d4e3db32db018adce1781234ba6
MD5 hash: cb021ba451c2c7d87025e965ecc8b39f
humanhash: timing-washington-video-mockingbird
File name:Urgent inquiry.com
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'713'664 bytes
First seen:2026-02-02 08:05:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'754 x AgentTesla, 19'662 x Formbook, 12'252 x SnakeKeylogger)
ssdeep 24576:LVqY5bM9XFHlRUIeB/eG9B6VjqIkcSAF9l:J1ZMnMB/IV+I7X
Threatray 300 similar samples on MalwareBazaar
TLSH T13485022523894778E9BE6B3484FB562093F0BDCBC736D72EA59C60FD0921F599680723
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:exe PhantomStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
CH CH
Vendor Threat Intelligence
Gathering data
Malware family:
n/a
ID:
1
File name:
Urgent inquiry.com
Verdict:
Malicious activity
Analysis date:
2026-02-02 08:06:32 UTC
Tags:
netreactor stealer crypto-regex phantom auto-reg
Link:
https://app.any.run/tasks/e6b51805-02dc-48e6-9b10-41c2eb864392

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51163/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.93757659.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69805ad3848d0f834c8cac11
Tags:
shell sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt formbook lolbin masquerade obfuscated obfuscated tracker vbnet
Link:
https://www.filescan.io/uploads/69805ac1930564ff3c83052a/reports/ed9731b5-a85d-4239-a87c-8e13b3c79e0f/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-01T17:41:00Z UTC
Last seen:
2026-02-02T09:42:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/596edc8d-1ec3-4bac-a4d5-b8029b0285e4
Result
Threat name:
DarkTortilla, KeyLogger, Phantom stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1861441
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected DarkTortilla Crypter
Yara detected Keylogger Generic
Yara detected Phantom stealer
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1861441 Sample: Urgent inquiry.com.exe Startdate: 02/02/2026 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Antivirus detection for URL or domain 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 16 other signatures 2->51 7 Urgent inquiry.com.exe 3 2->7         started        process3 file4 33 C:\Users\user\...\Urgent inquiry.com.exe.log, ASCII 7->33 dropped 53 Found many strings related to Crypto-Wallets (likely being stolen) 7->53 11 cmd.exe 3 7->11         started        15 cmd.exe 1 7->15         started        signatures5 process6 file7 35 C:\Users\user\AppData\Roaming\notepad.exe, PE32 11->35 dropped 37 C:\Users\user\...\notepad.exe:Zone.Identifier, ASCII 11->37 dropped 55 Uses ping.exe to sleep 11->55 17 notepad.exe 2 11->17         started        20 conhost.exe 11->20         started        22 PING.EXE 1 11->22         started        24 PING.EXE 1 11->24         started        57 Uses ping.exe to check the status of other devices and networks 15->57 26 PING.EXE 1 15->26         started        29 conhost.exe 15->29         started        31 reg.exe 1 1 15->31         started        signatures8 process9 dnsIp10 41 Antivirus detection for dropped file 17->41 43 Multi AV Scanner detection for dropped file 17->43 39 127.0.0.1 unknown unknown 26->39 signatures11
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86
Link:
https://app.malva.re/file/cb021ba451c2c7d87025e965ecc8b39f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6/
Verdict:
Malicious
Threat:
VHO:Trojan-Spy.Win32.Noon
Link:
https://tip.neiki.dev/file/4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-02-01 20:29:09 UTC
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jk6rnhboqkaldyj3gsxssg4rcochhox5jomwzybagy7veny5o63a._file
Verdict:
malicious
Label(s):
phantomstealer
Create hunting rule
Similar samples:
0daa3fc7e8c657b4e98fbd3be6b56c2c8950224945c5d0d3c10c2e4967637dce
PhantomStealer
1e0bbcaa4d9b3f4c144e10dad6fb9ecbde607e3c48c2d3194195f56852ef8ffb
PhantomStealer
31d5415b69274dbdcca1e80d57d649b9c643b6fc028d0af383f5040375a45870
PhantomStealer
4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
PhantomStealer
652a96c9a54fba5d57371552348acbcd596293f65195b45b782eed0727fdf727
PhantomStealer
815b1ccf52d1f815f76b46b5a23f203dc80debafb39e1b6c95d9d19863a69828
PhantomStealer
8b1ba565bae00818bc3eb21bc9632a2fbbd6a35fbe77b3034d99668776342584
PhantomStealer
9cbffe3435e4218fbfebedbbc72a2e587098bdd9eb4a4b3014a38d1d9869817b
PhantomStealer
error
PhantomStealer
fc3d9f89cc5a6b2824022593ed3ab4d94a72f71ef5f34953acc952141ad110f0
PhantomStealer
+ 290 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/260202-jy4ngacs3f/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Adds Run key to start application
.NET Reactor proctector
Executes dropped EXE
Unpacked files
SH256 hash:
4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
MD5 hash:
cb021ba451c2c7d87025e965ecc8b39f
SHA1 hash:
c9255df5ef638d4e3db32db018adce1781234ba6
Link:
https://www.unpac.me/results/9492a237-3693-4563-83fe-011ec88e96ca/
SH256 hash:
e8fd2ba3e6973d83e9d47a8a3927720d985116237b19ab98224b8c53e0501d71
MD5 hash:
4f844017df3330ccb00c2e4e2de4503b
SHA1 hash:
2fb551286b524bb9adf217efcffaf47b8efb98bf
Link:
https://www.unpac.me/results/9492a237-3693-4563-83fe-011ec88e96ca/
SH256 hash:
264f6c56e64e7f056e9a405e9b89a8d62a33c219df90f420b6a8c4aaa0ddf3ea
MD5 hash:
92fab9cbbd05b75fed4cc58012354e61
SHA1 hash:
411c2744672849a14b3761114eb7a4e32540215f
Detections:
phantom_stealer
Create hunting rule
cn_utf8_windows_terminal
Create hunting rule
INDICATOR_EXE_Packed_Fody
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames
Create hunting rule
Link:
https://www.unpac.me/results/9492a237-3693-4563-83fe-011ec88e96ca/
Parent samples :
b6eb415d7b1be65850ede04ebe14006c319b11be80702c1d10ffd58a915a4f0f
4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
b5c87ae305492fcb39c332e34bb86cf96e0906d89eb7bedf552b740a877ca97d
0cbb7f1b15b8cd50b8269b954738cbad9099994d60df5309ac5326c3886c3d10
eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f
SH256 hash:
fd7fb3258cf66e81004588e92d0716c2b958e11d58ec4cccdd34b707e2c629a5
MD5 hash:
c02c691102ab160e33c60e3309864755
SHA1 hash:
63d50f73a8c47fccdf27a076cb83ac4e4d90b45c
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Link:
https://www.unpac.me/results/9492a237-3693-4563-83fe-011ec88e96ca/
Parent samples :
256b9eb0b0ef69eeee00712c0e9fab59601934633f2bb6d0a0b10ac04bd5b2ab
0e211c13ea627d3f7ae9023d2d7c1f972f56f8f0c0cd3cf3a52b2565d2e638ca
b6eb415d7b1be65850ede04ebe14006c319b11be80702c1d10ffd58a915a4f0f
b59f237069f8faccd2b47d23767c95ef269ea70bd910ad816728568afb9bec65
3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792
67a9288baf5c274fae60465c54accb0973ea5e570c4eb992de3c5babc16b8dae
af45e7ab9d8c10b174c3ae27c54f39e69311c1716be6af42cc50eaaf96e29710
36d359de0808170809afdb8fa45e4403644de6eb4921eab83917d2952f3b6e2e
4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
43885d920258d6685b0896c6214b22b5c9f242b1ab76e75797abd91b09c52810
c3c30fc030de442cede5c078e0ba3ff227c4c57c10c23c4d7dba78e1147f3428
b5c87ae305492fcb39c332e34bb86cf96e0906d89eb7bedf552b740a877ca97d
cff9fc02dfb06bb740609505345e93c40b2b240734913b1122f2ca68a436bc2c
0cbb7f1b15b8cd50b8269b954738cbad9099994d60df5309ac5326c3886c3d10
8109a0528091c8be7fc71e941604672f1cfba50a020c9b4fce74be6e092764f4
65ca5368c87b5c53a24995aa3bb88240abf1766e2fd013ad10756e5006be286c
e53905be786890e707d3afe844cbb853b3b5db4f52768df923ac867a2659c3b1
897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
8e428ed7bec47c35783cca6568a6a8f8d5229669d1cce764d30ecac9ff9c28d4
Malware family:
PhantomStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4abd169c2e82/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

PhantomStealer

Executable exe 4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/51163/

Comments