MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5
SHA3-384 hash: c8630c98da0befca1dba6d366ab71112bf95c4a75e0beadcee638d422e6876cacffa94589d2c7fabc9c44de0de7e763f
SHA1 hash: a3dc49fbf9301603a97dbe3fb9188b1efba5a19b
MD5 hash: 6eb55297620741e8575d4ed7121298a2
humanhash: florida-aspen-carolina-idaho
File name:Files.09876543234567890.exe
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:388'808 bytes
First seen:2026-07-21 05:53:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ea4df5d94204fc550be1874e1b77ea7 (252 x GuLoader, 32 x RemcosRAT, 26 x VIPKeylogger)
ssdeep 6144:vwq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437AqfpwOvnttusYUTm:vzhufPAgEYFV0KOVw7UTA5
TLSH T19884BF423D0CA5DBED3D6372296785862FB4747A4B9216AFBAAFF21648413134E1FD0C
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 3b3ffd7d7f5e587f (2 x PhantomStealer, 1 x AsyncRAT)
Reporter lowmal3
Tags:exe PhantomStealer signed

Code Signing Certificate

Organisation:Slbevoddene
Issuer:Slbevoddene
Algorithm:sha256WithRSAEncryption
Valid from:2026-07-13T10:56:02Z
Valid to:2027-07-13T10:56:02Z
Serial number: 49b553e29df45ec1338a02061f9b99a0ddf41b36
Thumbprint Algorithm:SHA256
Thumbprint: 3e53781ef5fd8d4378e806c6ed83d855eee09cf27280c184e8597365cb35586e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d9c61105-b48d-4673-a3e6-f16268a7d1d5/
Malware family:
n/a
ID:
1
File name:
c2bb214e-352c-4634-ad10-8225ba69b529.zip
Verdict:
Malicious activity
Analysis date:
2026-07-21 01:19:23 UTC
Tags:
susp-attachments attachments attc-exe attc-arch arch-exec arch-email stealer auto generic ip-check evasion smtp
Link:
https://app.any.run/tasks/11bfcf62-8bff-4d7f-97f3-e227ea4181a8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75488/
Detection(s):
SecuriteInfo.com.FileRepMalware.78746769.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5f09acbcffb2c48cb7a7e5
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Searching for the window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Sending an HTTP GET request to an infection source
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance signed
Link:
https://www.filescan.io/uploads/6a5f097551b920655dc498a8/reports/277bb0de-0c22-43b9-8d68-832fc6b03f5a/overview
Verdict:
Malicious
Labled as:
VHO:Trojan.Makoob.gen
Link:
https://www.hybrid-analysis.com/sample/a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-20T21:22:00Z UTC
Last seen:
2026-07-23T04:35:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic Backdoor.Androm.HTTP.Download Trojan.Win32.Guloader.sb Trojan.NSIS.Makoob.sbb Trojan.NSIS.Makoob.sba Trojan-Dropper.Win32.Injector.sb Trojan.NSIS.Pakes.Krynis.sb Trojan.NSIS.Agent.sb HEUR:Trojan-Downloader.Win32.Minix.gen Trojan-Downloader.Win32.Minix.sb Packed.NSIS.Krynis.sb
Link:
https://opentip.kaspersky.com/a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5/results?tab=lookup
Malware family:
NSIS
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e4ee34eb-8d5c-43a1-a6dd-3c712fa12055
Result
Threat name:
GuLoader, Phantom stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1945633
Signature
AI detected suspicious PE / MSI digital signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Attempt to bypass Chrome Application-Bound Encryption
Contains functionality to compare user and computer (likely to detect sandboxes)
Early bird code injection technique detected
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected GuLoader
Yara detected Phantom stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1945633 Sample: Files.09876543234567890.exe Startdate: 21/07/2026 Architecture: WINDOWS Score: 100 60 smtp.ionos.es 2->60 74 Antivirus detection for dropped file 2->74 76 Multi AV Scanner detection for dropped file 2->76 78 Multi AV Scanner detection for submitted file 2->78 80 8 other signatures 2->80 11 Files.09876543234567890.exe 3 27 2->11         started        15 msedge.exe 8 2->15         started        signatures3 process4 file5 54 C:\Users\user\AppData\Local\...\System.dll, PE32 11->54 dropped 96 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->96 98 Tries to detect virtualization through RDTSC time measurements 11->98 100 Unusual module load detection (module proxying) 11->100 102 2 other signatures 11->102 17 Files.09876543234567890.exe 12 11->17         started        22 Files.09876543234567890.exe 11->22         started        24 msedge.exe 15->24         started        signatures6 process7 dnsIp8 56 smtp.ionos.es 213.165.67.103, 49788, 587 IONOS-ASThisisthejointnetworkforIONOSFasthostsArsys11MailandMediaand11TelecomFormerlyknownas11InternetSEDE Germany 17->56 58 192.3.136.217, 49767, 80 AS-COLOCROSSING-HostPapaUS United States 17->58 48 C:\Users\user\AppData\Local\...\Alkalies.exe, PE32 17->48 dropped 50 C:\Users\user\...\DumpBrowserSecrets.exe, PE32+ 17->50 dropped 82 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->82 84 Tries to steal Mail credentials (via file / registry access) 17->84 86 Found direct / indirect Syscall (likely to bypass EDR) 17->86 26 DumpBrowserSecrets.exe 13 17->26         started        30 Files.09876543234567890.exe 17->30         started        file9 signatures10 process11 file12 52 C:\Users\...\DllExtractChromiumSecrets.dll, PE32+ 26->52 dropped 88 Antivirus detection for dropped file 26->88 90 Multi AV Scanner detection for dropped file 26->90 92 Early bird code injection technique detected 26->92 94 4 other signatures 26->94 32 chrome.exe 26->32         started        34 msedge.exe 10 26->34         started        36 conhost.exe 26->36         started        signatures13 process14 process15 38 chrome.exe 4 32->38         started        41 msedge.exe 34->41         started        dnsIp16 62 192.168.2.13 unknown unknown 38->62 64 192.168.2.14 unknown unknown 38->64 66 4 other IPs or domains 38->66 43 chrome.exe 38->43         started        46 chrome.exe 38->46         started        process17 dnsIp18 68 googlehosted.l.googleusercontent.com 142.250.65.65, 443, 49780 GOOGLE-GoogleLLCUS United States 43->68 70 www.google.com 142.251.151.119, 443, 49770, 49779 GOOGLE-GoogleLLCUS United States 43->70 72 4 other IPs or domains 43->72
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/6eb55297620741e8575d4ed7121298a2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-21 05:55:56 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uisvotpn277re47abpptm6dgmottpcgmmyx7ksma5nlonmyx3pcq._file
Verdict:
malicious
Label(s):
CloudEyE
Create hunting rule
Link:
https://reports.threatray.com/a0ba76ba-d288-4725-bcdc-fead4621362b
Similar samples:
174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a
PhantomStealer
24a45d0b7b4fe778fe67729da5b9577b79bd42a847004110406fd57efec03ecc
PhantomStealer
397fe4ef3bbb8827014cc0a3a98fee725b181bb4605b8053a957225535ddb499
PhantomStealer
3e194727054b458a0c20e006fe98dc31b7bc88f3eb5566a3dcffad92a13ef834
PhantomStealer
812d449eb3750a33e26741c13a405b9c00c68306a26755dad33114c6980d78b8
PhantomStealer
cbc366eb88520c2f1a9c0db8a7f5318b4f8a9a0993352a31d877c63e8abc8d0c
PhantomStealer
cd9b8405e09bed643ec9f4310de2d377b0d686da1dda72bfb7953cda26024868
PhantomStealer
e282bdd0403b520c6dd0aaf92fac3cf587ec67371047cf648a55ecc1518221ce
PhantomStealer
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:phantom_stealer collection credential_access discovery downloader persistence spyware stealer
Link:
https://tria.ge/reports/260721-glrf9sht9w/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses Microsoft Outlook profiles
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Uses browser remote debugging
Family: Guloader,Cloudeye
Family: PhantomStealer
Unpacked files
SH256 hash:
a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5
MD5 hash:
6eb55297620741e8575d4ed7121298a2
SHA1 hash:
a3dc49fbf9301603a97dbe3fb9188b1efba5a19b
Link:
https://www.unpac.me/results/42c4966c-cfbd-434e-a83f-abb95fd1e29c/
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/42c4966c-cfbd-434e-a83f-abb95fd1e29c/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a225574dedd7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:NSIS
Create hunting rule
Author:kevoreilly
Description:NSIS Integrity Check function
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

PhantomStealer

Executable exe a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/75488/

Comments