MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PhantomStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 25 File information Comments

SHA256 hash:	55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29
SHA3-384 hash:	16a1851b90c5cf460bfa2248a147b4a3f74e43af3524db66f1f530b890285067c11debbeff75409c19b3b22f32adf364
SHA1 hash:	4177a1e8e62f44d18c566b21b1f568e5e5e1fd02
MD5 hash:	a16f0d8380db597c0f705207417f8792
humanhash:	emma-freddie-yankee-xray
File name:	55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29
Download:	download sample
Signature	PhantomStealer Create hunting rule
File size:	1'764'352 bytes
First seen:	2026-03-06 15:07:53 UTC
Last seen:	2026-03-06 15:31:02 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'853 x AgentTesla, 19'780 x Formbook, 12'304 x SnakeKeylogger)
ssdeep	24576:foEA2P4lTp3YHdCvVGEEKIcsjU6UsHMdrE6Jv3oqriYg1Ai4JhHo:fHA2PYp3MdCvMXvjxUsHcJv3fo
Threatray	281 similar samples on MalwareBazaar
TLSH	T10285F1357E834B41C627677AC5230E8423F0C5929653DB1FBFED01F8AA2A7B98A71351
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe PhantomStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/188fbfc9-ce6b-444b-bee3-d725490e44dd/

Malware family:

amadey

ID:

File name:

2to1ep.exe

Verdict:

Malicious activity

Analysis date:

2026-02-20 16:26:12 UTC

Tags:

auto metasploit framework arch-exec python amadey botnet stealer stealc github meterpreter backdoor clickfix possible-phishing phishing powershell barys generic telegram anti-evasion koistealer maskgramstealer tinynuke koiloader loader miner putty rmm-tool adaptixc2 formbook coinminer bruteratel donutloader networm amus njrat xred tool guloader santastealer cobaltstrike azorult maskgram masslogger discord credentialflusher redline stealerium rat gh0st quasar whitesnakestealer sheet xworm rhadamanthys pastebin ghostsocks proxyware pyinstaller bladabindi remcos vidar agenttesla asyncrat evasion svc muckstealer dcrat brat koi salatstealer hijackloader rustystealer pythonstealer goproxy gotoresolve amaterastealer schoolboy havoc fuery wannacry ransomware wallstealer anydesk

Link:

https://app.any.run/tasks/2c55ed47-157b-47ba-bba9-cd88f5d834e5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/56150/

Detection(s):

SecuriteInfo.com.Trojan.Inject6.27186.28915.7366.UNOFFICIAL

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69aaee61e1f958bf66849059

Tags:

virus micro msil

Verdict:

Malicious

Labled as:

Trojan.MSIL.Basic.8

Link:

https://www.hybrid-analysis.com/sample/55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29

Verdict:

Malicious

File Type:

exe x32

Link:

https://opentip.kaspersky.com/55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f1223e7e-9170-417f-8b13-e392ebd28ca7

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29/

Threat name:

ByteCode-MSIL.Trojan.Generic

Status:

Suspicious

First seen:

2026-02-20 00:57:52 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 36 (63.89%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kwu5sixjnzepnwx6lu5iajrgrtaqvy4vrnq3seq7bzgjh3okhmuq._file

Verdict:

malicious

Label(s):

purecrypter

phantomstealer

PhantomStealer

66158410eadaa76f6a183087c95b694a1404641be3a16b3b704f4cd56e53f20c

PhantomStealer

78826700c53185405a0a3897848ca8474920804a01172f987a18bd3ef9a4fc77

PhantomStealer

b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c

PhantomStealer

d52c6f80a2f8b77133d238743c79aca4554ba5f404e109a93ff9c2db115bd873

PhantomStealer

dbbb1c1ad17996d18e3e28537e0188b204657e87b8cb495e05bdb36c75cae466

PhantomStealer

ec5b91ad14060b955dec4c1fcd63be9d63d66185d463ea785e5f888eee460f0b

PhantomStealer

+ 271 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/260306-sh4szahs4r/

Behaviour

System Location Discovery: System Language Discovery

.NET Reactor proctector

Unpacked files

SH256 hash:

55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29

MD5 hash:

a16f0d8380db597c0f705207417f8792

SHA1 hash:

4177a1e8e62f44d18c566b21b1f568e5e5e1fd02

Link:

https://www.unpac.me/results/5d59cd2f-2fc2-4cb0-baaf-bbb2bebc991a/

SH256 hash:

a6a6cf76c8a7dd497424f636ddaa9c58a77971f9b267b257f1906c0388c281d6

MD5 hash:

f0ff6d188e5191a7295ae1e852259e7d

SHA1 hash:

c3f1b28ff5806069dc6b694eb2c40af6bdc27078

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

INDICATOR_EXE_Packed_DotNetReactor

Link:

https://www.unpac.me/results/5d59cd2f-2fc2-4cb0-baaf-bbb2bebc991a/

Parent samples :

24d6cbd8f4eb920651f82adb1288cd4d5227f6bcd8fe71341ebdeb434bbfae01
b430b6d8ffe30bb994eb58e11cab86092452755f0044acba6de4ef305f8fc28c
6f998e066e89d74f97f68b8b300cbf96f10df8bca0f96b78082e54ae578c6808
dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042
787603ed370b21f4b0c042915f7fec0e3ad9f1a74f9bea21a99f9e7a5232a31c
cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63
24a07efb7c95800b89d34683abe09cf8e7d7776483f586abca769c2f98bb67c6
5524f65612afc339bd726ce2d20c9b8040a2137c7c23d8b68c47fe35a02c616d
55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29
c2f557d0ec74807286105a5a4a0303d68638aaab4642aba9f035231742a0f38e
fdb5f65b86c93754b642aa54fa2628355c0bfd389bed24e435fef2d49ce6c8e4
4e5d15afc37e313296a27f94002517b351bad2dc3f3d1125e26ec078b57edbad
82cf55fa23c0c2493080bf0cbf52165ee502a58c782f8d85cfbbb5e601f8b6b3
9e82ffb9944fb58a8f2ea6c728ce6e3afa6560563666701d125b295fbf209bb3
b8e84695c8a14f7223d17d6957f4eb1ef4cadba8918911a5988b51a925042cfc
7157165f0ec7acf431db00aed0a0afbf01a2314396797399194ef0e80f6b2f54
4cc2ab119438950aeee01fd33fe268802e5362cb0d38349bf5df6269d9b8462f
d864a30d450157ee025d97dcd2a6a6bf386719fc4c14ca361f85aa914665657c

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_EXE_Packed_Fody Create hunting rule
Author:	ditekSHen
Description:	Detects executables manipulated with Fody

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM names

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM usernames

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon Create hunting rule
Author:	ditekSHen
Description:	Detects executables with interest in wireless interface using netsh

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	Windows_Generic_Threat_f57e5e2a Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Xeno_89f9f060 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PhantomStealer

exe 55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3679147/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/56150/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample