MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa
SHA3-384 hash: 3684fc7745a476bb5322e1ec670120c8753a89a80524aeabbb9eca538c3d53302eac5f0559cb74fb56673823ec2436a0
SHA1 hash: 1267e369e73b2274e787075ca9693c5086cf4b4b
MD5 hash: 0e64ed20c2b0d064ac772dfe597014d9
humanhash: maryland-sierra-mississippi-football
File name:7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'539'584 bytes
First seen:2026-05-08 12:45:24 UTC
Last seen:2026-06-08 08:53:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'116 x AgentTesla, 20'118 x Formbook, 12'357 x SnakeKeylogger)
ssdeep 24576:Alddce8+v9/KHex9rQkBTNE6Rp0tqOSojckCJowN4lQ3lx9WCms6P8ZB/XCe1j6q:AlddTvIHe/QkBTN+qb4guwyO1TW5sFvo
Threatray 634 similar samples on MalwareBazaar
TLSH T16E652304B647D802DCC1177584E5D67803765E8DE912C21BAEFCBEFBB86A72E6C085C2
TrID 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.4% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe PhantomStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
74
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/981c1322-86f6-43d7-941b-1f9288df20f5/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-05-08 16:59:37 UTC
Tags:
susp-lnk auto-startup stealer phantom evasion smtp
Link:
https://app.any.run/tasks/013bf09e-fa32-482c-a90b-82e9e8171503

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/65129/
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
net_reactor obfuscated packed packed vbnet
Link:
https://www.filescan.io/uploads/69fddb42fd9cdd68416eae53/reports/2e0557a1-c410-4ed8-b251-5d87d1cd35df/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-07T22:20:00Z UTC
Last seen:
2026-05-09T19:55:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c0bfaca7-e0d9-4a3a-8331-e21693f5fab7
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa/
Threat name:
ByteCode-MSIL.Trojan.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2026-04-08 02:05:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=of3lwbgirj2qvnu4utuo3qawtafcft7z2qvs6q5v7urbrrqwiova._file
Verdict:
malicious
Label(s):
phantomstealer
Create hunting rule
Similar samples:
262bb0abdf65d6d2baa592eb249d2693281a1c9c6180d1e46c57e79f52cb37b4
PhantomStealer
6e077e8b2d9fc9a2e9ea4f10a541d43835a0db3951061b32975ffa0ef064554f
PhantomStealer
8a999c3ff175f5de85b7af07af8f9c799a90a55c283d4b47f17d1bd1bba28a87
PhantomStealer
8b1ba565bae00818bc3eb21bc9632a2fbbd6a35fbe77b3034d99668776342584
PhantomStealer
9d49ed07f55c68f2aaa92799afe867420d4d828f2891e4498385a1eb0d90b0e3
PhantomStealer
ad5ade444bb7022dbb9ef78250e22a3991293531062f44b665cf410b128d0850
PhantomStealer
b9de8a6dfc4d7d04b31b9ad025430854e0c68e6bbe2e51b7344128d8f4f492f6
PhantomStealer
dcbc11334c0273afead141a14c127662e1caa06bc6ba0b119d1bbc67d1f0e148
PhantomStealer
f09a097b958bc565b990c17bb42765b488386fc2803a41872296db6923f09c32
PhantomStealer
fc3d9f89cc5a6b2824022593ed3ab4d94a72f71ef5f34953acc952141ad110f0
PhantomStealer
+ 624 additional samples on MalwareBazaar
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection discovery persistence stealer
Link:
https://tria.ge/reports/260508-p18m4acy3r/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Drops startup file
Detects PhantomStealer written in C#
Family: PhantomStealer
Unpacked files
SH256 hash:
7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa
MD5 hash:
0e64ed20c2b0d064ac772dfe597014d9
SHA1 hash:
1267e369e73b2274e787075ca9693c5086cf4b4b
Link:
https://www.unpac.me/results/a79c8528-f33f-4999-8559-8956929cba94/
SH256 hash:
85ee45b6961c855e6bfac50f2d4ec23ef1a78c9f6b664fb3f1a24888dcfb7c9c
MD5 hash:
c0a2d837b5eac770dcc38e783851fd93
SHA1 hash:
323620635fd9d576e070586105be3834a7c9c08b
Link:
https://www.unpac.me/results/a79c8528-f33f-4999-8559-8956929cba94/
SH256 hash:
8edbb28bdd121f23e0432e65d2412cb93e276816bc3b634e78d14ab0931b58e6
MD5 hash:
b21240dda9368aebe4fdd0e03df43503
SHA1 hash:
9802050d6d6ddbcfdc6dd02d9c8a9e1e1763ab0e
Link:
https://www.unpac.me/results/a79c8528-f33f-4999-8559-8956929cba94/
SH256 hash:
79a8e14b9258604a58ff73a7c5531fb2ce157a166a77c2ed69f678620ab6611c
MD5 hash:
4659006787647a5363fcc34811a7b9a4
SHA1 hash:
d30f01502e1824156c7eb31191bfb31b342f0e42
Detections:
phantom_stealer
Create hunting rule
Link:
https://www.unpac.me/results/a79c8528-f33f-4999-8559-8956929cba94/
Parent samples :
cbb7c0efe21f2608e505c657bd65e1921ab6ec7d05ba8531387b28d3857a719e
59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4
7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa
a073c1ccefa9613ac2cff88a9a7455f15b9b834c2bb5f93ee523e06f1c895847
f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff
22f734f721052d5fdb9bc8da8cae323d25d5e8bb001b4481fe41ca66cab2a05e
Malware family:
PhantomStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7176bb04c88a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/65129/

Comments