MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4eff48aab8e16eb897373d905b5f196444ace5adb6bc5560400a7a24a5b5fde6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PhantomStealer

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	4eff48aab8e16eb897373d905b5f196444ace5adb6bc5560400a7a24a5b5fde6
SHA3-384 hash:	4d97e0c7d13849bd0532a5c7ea8f1464ad8627f56d87f667bd64723d506391e2b67a22eaa5ae3f20b3410db88435119f
SHA1 hash:	e84e006d833638b7cf12e4de0baa5fa46b2e48e8
MD5 hash:	cfb89567314b25327827196240b8c6e6
humanhash:	tennis-lactose-november-carbon
File name:	Request for quotation-TAXC JAVS-1298123432896066.pdf.txz
Download:	download sample
Signature	PhantomStealer Create hunting rule
File size:	22'111 bytes
First seen:	2025-10-21 09:01:07 UTC
Last seen:	2025-10-21 10:49:01 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	384:1RujuXiaZgzgxqTfRGOW34G0r+AVFey7Y/ccxQ+5CdZzxQNRng0Iuu:1RujuXiaOztsEiA777YnQJGNRnRy
TLSH	T1CBA2E14782020426FE5D6EBE34585B1E66BD25B3669E74B2CE3029C457C66DB2336C23
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	PhantomStealer QUOTATION rar txz

cocaman

Malicious email (T1566.001)
From: "Andrea Luca <export@crestonsteel.it.com>" (likely spoofed)
Received: "from mail.crestonsteel.it.com (mail.crestonsteel.it.com [192.3.180.232]) "
Date: "21 Oct 2025 03:48:32 -0700"
Subject: "Reminder - Price Quotation Request"
Attachment: "Request for quotation-TAXC JAVS-1298123432896066.pdf.txz"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Request for quotation-TAXC JAVS-1298123432896066_pdf.js
File size:	1'016'104 bytes
SHA256 hash:	0dfc2c6e8167124259ffa9044bf04f3f06b05e8338dc9885f01eec92256eba19
MD5 hash:	674238aa39e5a96b9a4c04572e7e9e8c
MIME type:	application/x-wine-extension-ini
Signature	PhantomStealer

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68f74c163edd081eba4050cd

Tags:

spawn

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint masquerade

Link:

https://www.filescan.io/uploads/68f74c3dfd2d7e012f4bd016/reports/24541ec2-ccd0-462e-a8d7-5f8aaeb0beef/overview

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/4eff48aab8e16eb897373d905b5f196444ace5adb6bc5560400a7a24a5b5fde6

Verdict:

Malicious

File Type:

rar

First seen:

2025-10-21T06:05:00Z UTC

Last seen:

2025-10-22T11:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4eff48aab8e16eb897373d905b5f196444ace5adb6bc5560400a7a24a5b5fde6/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/cfb89567314b25327827196240b8c6e6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4eff48aab8e16eb897373d905b5f196444ace5adb6bc5560400a7a24a5b5fde6/

Verdict:

Malicious

Threat:

Trojan.Script.Agent

Link:

https://tip.neiki.dev/file/4eff48aab8e16eb897373d905b5f196444ace5adb6bc5560400a7a24a5b5fde6

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j37urkvy4fxlrfzxhwifwxyzmrckzznnw26fkycabj5cjjnv7xta._file

Result

Malware family:

phantomstealer

Score:

10/10

Tags:

family:phantomstealer adware collection discovery execution persistence spyware

Link:

https://tria.ge/reports/251021-np33sstqck/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Badlisted process makes network request

Phantomstealer family

Malware Config

C2 Extraction:

https://api.telegram.org/bot8458785334:AAGBvJVivkLeP9vHbvOWzZxBtCUpCFVEdvs/sendMessage?chat_id=1934716051

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4eff48aab8e16eb897373d905b5f196444ace5adb6bc5560400a7a24a5b5fde6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)