MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4
SHA3-384 hash: faf988ec869530f78dd111c0bd866d177b5810e5b28385ca04ab5e75577da78ed1a68b1b7c4e1ab10527e97925f5118c
SHA1 hash: 5455a36ad582b33e855e5aa7dedca07eca278302
MD5 hash: c5d19dd5fb7f162c206ca78481bd1182
humanhash: michigan-maine-utah-video
File name:59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'521'152 bytes
First seen:2026-05-08 12:43:21 UTC
Last seen:2026-06-08 08:51:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'116 x AgentTesla, 20'118 x Formbook, 12'357 x SnakeKeylogger)
ssdeep 24576:y8+v9jEXQ5oM+TDhi2s9MrXQVGLO941y2LxLA5UqGJN2J+gvcfkOUVAM:IvuXx51agQb4Y2LZA5U12Jv2P
Threatray 591 similar samples on MalwareBazaar
TLSH T1A8652214369CDA12E9A517F04AA5E77013B49C89A512C317CEFEBCFB7832B5A290C747
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe PhantomStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
71
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/74b9a21b-05c7-4a41-9139-fac891158381/
Malware family:
n/a
ID:
1
File name:
6980cac7ac51d96a5f8b396805d483246ff18a140da95589b3a43a095378a73f.zip
Verdict:
Malicious activity
Analysis date:
2026-04-08 11:32:15 UTC
Tags:
arch-exec auto-startup stealer phantom crypto-regex evasion
Link:
https://app.any.run/tasks/c168636b-a3c4-4561-93fd-120ac9d32458

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/65110/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69d63cbd6a61012f6ad00c8e
Tags:
redline emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Connection attempt
Sending an HTTP GET request
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt packed vbnet
Link:
https://www.filescan.io/uploads/69fdda9f7d31ad7bba4f62db/reports/2f51a7ff-bc39-4a30-bccb-6ec799f4e404/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-08T04:31:00Z UTC
Last seen:
2026-05-10T10:02:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b29ccd75-c2cd-4d81-b905-4ea5c2956c5a
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-04-08 10:10:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lhzhvanpf7gjlmrfha23fszdifyz7kcq3syvrsxxigyfvnh2ddsa._file
Verdict:
malicious
Label(s):
phantomstealer
Create hunting rule
Similar samples:
262bb0abdf65d6d2baa592eb249d2693281a1c9c6180d1e46c57e79f52cb37b4
PhantomStealer
6e077e8b2d9fc9a2e9ea4f10a541d43835a0db3951061b32975ffa0ef064554f
PhantomStealer
8a999c3ff175f5de85b7af07af8f9c799a90a55c283d4b47f17d1bd1bba28a87
PhantomStealer
8b1ba565bae00818bc3eb21bc9632a2fbbd6a35fbe77b3034d99668776342584
PhantomStealer
9d49ed07f55c68f2aaa92799afe867420d4d828f2891e4498385a1eb0d90b0e3
PhantomStealer
ad5ade444bb7022dbb9ef78250e22a3991293531062f44b665cf410b128d0850
PhantomStealer
b9de8a6dfc4d7d04b31b9ad025430854e0c68e6bbe2e51b7344128d8f4f492f6
PhantomStealer
dcbc11334c0273afead141a14c127662e1caa06bc6ba0b119d1bbc67d1f0e148
PhantomStealer
error
PhantomStealer
f09a097b958bc565b990c17bb42765b488386fc2803a41872296db6923f09c32
PhantomStealer
fc3d9f89cc5a6b2824022593ed3ab4d94a72f71ef5f34953acc952141ad110f0
PhantomStealer
+ 581 additional samples on MalwareBazaar
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection discovery persistence stealer
Link:
https://tria.ge/reports/260508-pzenmacx7j/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Drops startup file
Detects PhantomStealer written in C#
Family: PhantomStealer
Unpacked files
SH256 hash:
59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4
MD5 hash:
c5d19dd5fb7f162c206ca78481bd1182
SHA1 hash:
5455a36ad582b33e855e5aa7dedca07eca278302
Link:
https://www.unpac.me/results/308eab3c-3354-42fc-8b7d-3906b0a07900/
SH256 hash:
5aa4f0275dcabc77a16c8d5e92bfe0ae51eb1c42a72387b224032da8e06649b4
MD5 hash:
68c7b60e7344728d710f6f94d7331618
SHA1 hash:
31ecaada304bd6e71c7bc1966bdb7b6aad556a34
Link:
https://www.unpac.me/results/308eab3c-3354-42fc-8b7d-3906b0a07900/
SH256 hash:
8edbb28bdd121f23e0432e65d2412cb93e276816bc3b634e78d14ab0931b58e6
MD5 hash:
b21240dda9368aebe4fdd0e03df43503
SHA1 hash:
9802050d6d6ddbcfdc6dd02d9c8a9e1e1763ab0e
Link:
https://www.unpac.me/results/308eab3c-3354-42fc-8b7d-3906b0a07900/
SH256 hash:
79a8e14b9258604a58ff73a7c5531fb2ce157a166a77c2ed69f678620ab6611c
MD5 hash:
4659006787647a5363fcc34811a7b9a4
SHA1 hash:
d30f01502e1824156c7eb31191bfb31b342f0e42
Detections:
phantom_stealer
Create hunting rule
Link:
https://www.unpac.me/results/308eab3c-3354-42fc-8b7d-3906b0a07900/
Parent samples :
cbb7c0efe21f2608e505c657bd65e1921ab6ec7d05ba8531387b28d3857a719e
59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4
7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa
a073c1ccefa9613ac2cff88a9a7455f15b9b834c2bb5f93ee523e06f1c895847
f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff
22f734f721052d5fdb9bc8da8cae323d25d5e8bb001b4481fe41ca66cab2a05e
Malware family:
PhantomStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/59f27a81af2f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/65110/

Comments