MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5897bd744f6475c8fc968a09e59b5043612eed4416353f182525ff8d64ec9411. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5897bd744f6475c8fc968a09e59b5043612eed4416353f182525ff8d64ec9411
SHA3-384 hash:	0d1da2b96ed43a4665cea2affb3d16195059a7d245da912d08ecf021e2baf01546400692722a87c32358e5353f4b44be
SHA1 hash:	c9c15129d0098e71084287c30bba0a3036758c7f
MD5 hash:	323dbab2dc8816c290553a2dc86b9a68
humanhash:	mockingbird-mars-twelve-magazine
File name:	nRFQ_Clinica_Radiologia_PDF.tar
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	891'566 bytes
First seen:	2026-07-24 06:30:11 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-rar
ssdeep	12288:FCG9frG5/lAp5f8doZcc+gUk67xbBKOqoCe+nPHDxk+l6wgS+d/bxHVoJM/LtR6s:FCsGjAJdGbwjxhgx5x1ou/LqyBp
TLSH	T1D0153325FEE8477045179A6A618C49F1A33B04D098CF391F633DB8966FAEC4DC5EE1A0
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	FXOLabs
Tags:	PhantomStealer tar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

63

Origin country :

BR

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/6d3b5f6e-3fb7-4453-8fe2-5e49969bbf9d/

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5897bd744f6475c8fc968a09e59b5043612eed4416353f182525ff8d64ec9411

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5897bd744f6475c8fc968a09e59b5043612eed4416353f182525ff8d64ec9411/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lcl325cpmr24r7ewrie6lg2qinqs53kecy2t6gbfex7y2zhmsqiq._file

Hatching Triage phantom_stealer

Result

Malware family:

phantom_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:phantom_stealer collection discovery execution persistence stealer

Link:

https://tria.ge/reports/260724-jctalstyfy/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Family: PhantomStealer

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5897bd744f6475c8fc968a09e59b5043612eed4416353f182525ff8d64ec9411