MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58ba838860f2baa915c2e0e3a310c9695084d58fdd8cc95c4723ffef84c472a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58ba838860f2baa915c2e0e3a310c9695084d58fdd8cc95c4723ffef84c472a1
SHA3-384 hash: 803c0b87066749f96ac5dca83337f87d3a1fba0287df5944fd05b9be6c418cf39ad0de4423e601331f64e7dca8ad6d34
SHA1 hash: ad636bd37060504d09a35ad989a6bfb3871dc138
MD5 hash: 4c4528aea7a10ee3adfc5251a07ddb90
humanhash: item-sink-florida-uniform
File name:OOOK.vbs
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:5'977'940 bytes
First seen:2025-10-07 18:34:28 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:Mrl1rldrl1rldrl1rldrl1rldrl1rldrl1rldrl1rldrl1rldrl1rldrl1rldrl1:lVEgFjE5VwYyyFmmmmmmmmmmmmmLEoy
Threatray 62 similar samples on MalwareBazaar
TLSH T1115611EE96E52E4CF7900079F223F8381557B414857E9AAA117B4FED6F86D082D86333
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika unknown
Reporter abuse_ch
Tags:PhantomStealer vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
37
Origin country :
SE SE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/31023/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e55da07f305fa2545d5ac4
Tags:
autorun xtreme shell sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 evasive obfuscated powershell
Link:
https://www.filescan.io/uploads/68e55db4d4a0085473c31bde/reports/3a7539a7-fcfb-4bbc-bd4f-5de9c4ddfc98/overview
Verdict:
Malicious
Labled as:
GT:VB.Honolulu.1
Link:
https://www.hybrid-analysis.com/sample/58ba838860f2baa915c2e0e3a310c9695084d58fdd8cc95c4723ffef84c472a1
Verdict:
Malicious
File Type:
unknown
First seen:
2025-10-06T17:56:00Z UTC
Last seen:
2025-10-08T13:40:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/58ba838860f2baa915c2e0e3a310c9695084d58fdd8cc95c4723ffef84c472a1/results?tab=lookup
Result
Threat name:
Phantom stealer, Strela Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1790878
Signature
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
AI detected malicious Powershell script
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Creates autostart registry keys with suspicious values (likely registry only malware)
Encrypted powershell cmdline option found
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected Phantom stealer
Yara detected Powershell download and execute
Yara detected Strela Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1790878 Sample: OOOK.vbs Startdate: 07/10/2025 Architecture: WINDOWS Score: 100 96 pastebin.com 2->96 98 dpaste.org 2->98 100 bg.microsoft.map.fastly.net 2->100 108 Found malware configuration 2->108 110 Malicious sample detected (through community Yara rule) 2->110 112 Multi AV Scanner detection for submitted file 2->112 116 25 other signatures 2->116 12 wscript.exe 1 2->12         started        15 powershell.exe 2->15         started        17 powershell.exe 2->17         started        19 2 other processes 2->19 signatures3 114 Connects to a pastebin service (likely for C&C) 96->114 process4 dnsIp5 142 Suspicious powershell command line found 12->142 144 Wscript starts Powershell (via cmd or directly) 12->144 146 Uses schtasks.exe or at.exe to add and modify task schedules 12->146 150 2 other signatures 12->150 22 powershell.exe 7 12->22         started        25 schtasks.exe 1 12->25         started        27 schtasks.exe 1 12->27         started        29 wscript.exe 15->29         started        31 conhost.exe 15->31         started        33 wscript.exe 17->33         started        35 conhost.exe 17->35         started        102 127.0.0.1 unknown unknown 19->102 148 Wscript called in batch mode (surpress errors) 19->148 37 conhost.exe 19->37         started        39 wscript.exe 19->39         started        signatures6 process7 signatures8 126 Suspicious powershell command line found 22->126 128 Found many strings related to Crypto-Wallets (likely being stolen) 22->128 130 Encrypted powershell cmdline option found 22->130 134 3 other signatures 22->134 41 powershell.exe 14 18 22->41         started        45 conhost.exe 22->45         started        47 conhost.exe 25->47         started        49 conhost.exe 27->49         started        132 Wscript starts Powershell (via cmd or directly) 29->132 51 powershell.exe 29->51         started        54 powershell.exe 33->54         started        process9 dnsIp10 104 pastebin.com 104.20.29.150, 443, 49698, 49700 CLOUDFLARENETUS United States 41->104 106 dpaste.org 104.20.36.119, 443, 49699, 49701 CLOUDFLARENETUS United States 41->106 94 C:\Users\user\AppData\Local\Temp\nAvER.ps1, Unicode 41->94 dropped 56 powershell.exe 15 41->56         started        118 Wscript called in batch mode (surpress errors) 51->118 60 conhost.exe 51->60         started        62 wscript.exe 51->62         started        64 conhost.exe 54->64         started        66 wscript.exe 54->66         started        file11 signatures12 process13 file14 90 __________________...________-------.lnk, MS 56->90 dropped 92 C:\Users\user\AppData\Local\Temp\xx2.vbs, ASCII 56->92 dropped 136 Found many strings related to Crypto-Wallets (likely being stolen) 56->136 138 Writes to foreign memory regions 56->138 140 Injects a PE file into a foreign processes 56->140 68 powershell.exe 23 56->68         started        71 MSBuild.exe 4 56->71         started        73 powershell.exe 11 56->73         started        75 powershell.exe 56->75         started        signatures15 process16 signatures17 120 Loading BitLocker PowerShell Module 68->120 77 powershell.exe 68->77         started        122 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 71->122 124 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 71->124 80 cmd.exe 71->80         started        process18 signatures19 152 Creates autostart registry keys with suspicious values (likely registry only malware) 77->152 154 Creates autostart registry keys with suspicious names 77->154 82 conhost.exe 80->82         started        84 chcp.com 80->84         started        86 taskkill.exe 80->86         started        88 timeout.exe 80->88         started        process20
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/58ba838860f2baa915c2e0e3a310c9695084d58fdd8cc95c4723ffef84c472a1
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58ba838860f2baa915c2e0e3a310c9695084d58fdd8cc95c4723ffef84c472a1/
Verdict:
Malicious
Threat:
Trojan-PSW.Win32.Stealerium
Link:
https://tip.neiki.dev/file/58ba838860f2baa915c2e0e3a310c9695084d58fdd8cc95c4723ffef84c472a1
Threat name:
Win32.Trojan.Honolulu
Create hunting rule
Status:
Malicious
First seen:
2025-10-07 00:03:33 UTC
File Type:
Binary
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lc5ihcda6k5ksfoc4dr2gegjnfiijvmp3wgmsxchep767bgeokqq._file
Verdict:
malicious
Label(s):
xenostealer
Create hunting rule
Similar samples:
03211407b165e3d6fbd3f1bb59c2e20b506e6cfae4c7424592e7d1cc7c564fbd
PhantomStealer
122ce2c88c8be8e67efafc15d1458811c6b052a315cc4e75e8f0f050859fce47
PhantomStealer
17440815b289ab03ed1a2906514a94940a12f2270ec5e39c819d786fd36349c4
PhantomStealer
56014a5ec7d4be83b5fbe439b9142654a267619981184bb757fb325edd4f3b08
PhantomStealer
57a71e4d5ce81f7931e9f9814b2ba93127f3238d76afcb7ece25d27dbd3d5d12
PhantomStealer
error
PhantomStealer
+ 52 additional samples on MalwareBazaar
Result
Malware family:
phantomstealer
Create hunting rule
Score:
  10/10
Tags:
family:phantomstealer defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/251007-w836xa1nz9/
Behaviour
Delays execution with timeout.exe
Kills process with taskkill
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Hide Artifacts: Hidden Window
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Drops startup file
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Phantomstealer family
Malware Config
Dropper Extraction:
https://pastebin.com/raw/jgKWLc0S
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58ba838860f2baa915c2e0e3a310c9695084d58fdd8cc95c4723ffef84c472a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames
Create hunting rule
Author:ditekSHen
Description:Detects executables containing possible sandbox analysis VM names
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
Create hunting rule
Author:ditekSHen
Description:Detects executables containing possible sandbox analysis VM usernames
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon
Create hunting rule
Author:ditekSHen
Description:Detects executables with interest in wireless interface using netsh
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Generic_Threat_f57e5e2a
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Xeno_89f9f060
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31023/

Comments