MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f
SHA3-384 hash: b19419113d579015ec9d251673735344d32450f2187223883267ea7ecbf326a9089138e99525d4efb863fa006a1c92cc
SHA1 hash: 9e8bea470528f45eb9a2c97a935364ccf2b0f884
MD5 hash: 051581ff6c5a94b86269983bf268e426
humanhash: moon-indigo-oven-bakerloo
File name:6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f.ps1
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'638 bytes
First seen:2026-07-21 05:57:13 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 24:PEU6iR9NIgCSxfiQzNb4Z/1Z0kPLw1QZSdhs2UKC2U2xJ3oifgSczjICm:P5vZh5iQzNo1uL1QZSdhsx3ukjBm
TLSH T1B43165317063869C5F8F40567DA99A84D82851974008EC20FECF56F4AFC9738D7BB6C4
TrID 50.0% (.INI) Generic INI configuration (1000/1)
50.0% (.JSON) JSON array (generic) (1000/1)
Magika powershell
Reporter JAMESWT_WT
Tags:FAMILY-TRIP-BOOKING PhantomStealer ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5f0a7e85479d70bfb78e2f
Tags:
ransomware hype
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto downloader obfuscated opendir overlay
Link:
https://www.filescan.io/uploads/6a5f0a5c51b920655dc49b31/reports/37f9ef54-3569-4d7d-9439-b2f6db2bb7ff/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f
Verdict:
Malicious
File Type:
ps1
First seen:
2026-07-20T17:19:00Z UTC
Last seen:
2026-07-22T23:21:00Z UTC
Hits:
~10
Detections:
Trojan-Downloader.WinLNK.Agent.a Trojan-Downloader.Agent.HTTP.ServerRequest
Link:
https://opentip.kaspersky.com/6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f/results?tab=lookup
Score:
79%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated PowerShell T1027 T1059.001
Link:
https://app.malva.re/file/051581ff6c5a94b86269983bf268e426
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f/
Threat name:
Script-PowerShell.Trojan.Boxter
Create hunting rule
Status:
Malicious
First seen:
2026-07-21 03:54:02 UTC
File Type:
Text (PowerShell)
AV detection:
6 of 38 (15.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nvxafxdzbadtqpcuzsrmyd57d2p7pbodkv6zap6dxzizpua65ohq._file
Verdict:
malicious
Label(s):
PhantomStealer
Create hunting rule
Link:
https://reports.threatray.com/176729a8-3adf-4781-8e84-f3818c321390
Similar samples:
2b48b4d74ec2b1cfbd9e732c2b4d1c58c82882007ab5624c74b15657feb9641d
PhantomStealer
2d534e78f0623199febb46e3aa638dc79db2fb932fe52a3e5e7fb13ac2a6723f
PhantomStealer
46bb4585a2d85b325ebc69245e373262a9de2c7a8eb552835026e2ccef140a21
PhantomStealer
59dd87e52bca0e8e8137467e02cfe02297183a8ec8e85e9177b73e9757993440
PhantomStealer
62eb7393b9162692f01c1a9e350c3f1af79294ad6961f61f27e629046b77514d
PhantomStealer
6af6d8fe02670f84138d3b0e4863f548fa9c47a19e51094225ede3650492456d
PhantomStealer
6eb2760cf83de7f1eb63287bc4822f1a151f70f9c1598e999f47572d80a0c4dc
PhantomStealer
76f4040829c84eaf58b7cfc292b7d378ceab505e9bd78eb8ef8482e516885a23
PhantomStealer
bd6f1caabd3085c03a3286c3f0007901d68c5c89d4d1d67b96d4ed623f72bbf0
PhantomStealer
d0b4afda9fdb84d932510b39ed0bee58a08f7f0fb0437e34586734c9cec7433d
PhantomStealer
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection execution stealer
Link:
https://tria.ge/reports/260721-gpexmsf18n/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Command and Scripting Interpreter: PowerShell
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Uses the VBS compiler for execution
Badlisted process makes network request
Family: PhantomStealer
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands
Rule name:rhadamanthys_ps1_v1
Create hunting rule
Author:RandomMalware
Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments