MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749
SHA3-384 hash:	e2a0b77806ccfbae8fe22c0584e727915acada3b8dd069cdece8ba0314fcb99c16ca9e3553bfe143ecc5dfd2eeab0898
SHA1 hash:	e0485c03d3570701b3449d487450b8b117d13ecb
MD5 hash:	ca465e8a45332df121ce3b670bb3d414
humanhash:	missouri-blossom-hawaii-nineteen
File name:	NOTIS PERINGATAN BERKAITAN KEGAGALAN MEMBAYAR KESELURUHAN CUKAI TERMASUK PENALTI DI BAWAH AKTA CUKAI PERKHIDMATAN 2018.js
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	43'767 bytes
First seen:	2026-07-02 15:02:05 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:t/ibV9ATKPTkeZ0Aryg3dqwBUVKeaHKZpZ38wGd8p:librgKPTk+fr5lBUqHKZpZsJY
TLSH	T1B313868D3EC3A0924352D07F3E2BF5D9F1AE0CC5765880C9F675B44AF8A8B18D936658
Magika	javascript
Reporter	lowmal3
Tags:	js PhantomStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

132

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.32424.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a467da3949bf83c342ba750

Tags:

vmdetect keylog shell word

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

downloader evasive obfuscated repaired

Link:

https://www.filescan.io/uploads/6a467d9a4bd8516d59ec51fc/reports/9bbe07ef-e042-4a9d-a977-33eb21a9d7df/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-01T00:21:00Z UTC

Last seen:

2026-07-02T10:58:00Z UTC

Hits:

~100

Detections:

Trojan-Downloader.Agent.HTTP.C&C PDM:Trojan.Win32.Generic Trojan-Downloader.JS.SLoad.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic Trojan-PSW.Fareit.HTTP.C&C

Link:

https://opentip.kaspersky.com/abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749/results?tab=lookup

Joe Sandbox KeyLogger, Phantom stealer

Result

Threat name:

KeyLogger, Phantom stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.troj.spyw.expl

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1936832

Signature

AI detected malicious Powershell script

Allocates memory in foreign processes

Antivirus detection for URL or domain

Browser instances using unsafe startup parameters

Bypasses PowerShell execution policy

Creates a thread in another existing process (thread injection)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential obfuscated javascript found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected Costura Assembly Loader

Yara detected Generic JS Downloader

Yara detected Keylogger Generic

Yara detected Phantom stealer

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749/

Neiki Family.PHANTOM

Verdict:

Malicious

Threat:

Family.PHANTOM

Link:

https://tip.neiki.dev/file/abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-01 03:27:16 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 36 (30.56%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vo3qa4f32gfqhaqg52fltgnip5js37wxamfbcfcfj7nadpfpc5eq._file

Hatching Triage phantom_stealer

Result

Malware family:

phantom_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:phantom_stealer adware collection discovery execution persistence ransomware spyware stealer

Link:

https://tria.ge/reports/260702-sev2nadx6p/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Enumerates connected drives

Looks up external IP address via web service

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Detects PhantomStealer written in C#

Family: PhantomStealer

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749