MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 afa95f8089310841b669215cc5b699fe05c7560dc2e180387e60a129a91cdd7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
PhantomStealer
Vendor detections: 14
| SHA256 hash: | afa95f8089310841b669215cc5b699fe05c7560dc2e180387e60a129a91cdd7b |
|---|---|
| SHA3-384 hash: | f8e57286bc8056b2b9800dff3fdce4e84418531d739c9de80160ae9d5c386ac942565d2ecf412b3ad2f2885cb51a8716 |
| SHA1 hash: | b1509998859103b3a828951ff971f6f4f67cf4b9 |
| MD5 hash: | 08d04806a27d83a5d32663b1f0066701 |
| humanhash: | cola-queen-alanine-maryland |
| File name: | afa95f8089310841b669215cc5b699fe05c7560dc2e180387e60a129a91cdd7b |
| Download: | download sample |
| Signature | PhantomStealer |
| File size: | 1'609'216 bytes |
| First seen: | 2026-08-10 13:25:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'190 x AgentTesla, 20'337 x Formbook, 12'364 x SnakeKeylogger) |
| ssdeep | 49152:7hR9AVEKkh86TY/QUeFwDWhOyVeF0Xa6Qk:7bWVZkm6Tg5eFwDoKF0Xa65 |
| TLSH | T1B07523D03739B709DD260930A838EEB512B92DA8B024BAF25EED7F5B795D2019D0DF41 |
| TrID | 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | c4c4c4ccfcccf670 (5 x AgentTesla, 4 x SnakeKeylogger, 4 x NetWire) |
| Reporter |  adrian__luca |
| Tags: | exe PhantomStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
57
Origin country :
HUVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Detection:
PhantomStealer
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Creating a process from a recently created file
Reading critical registry keys
Deleting a recently created file
Launching a process
Loading a suspicious library
DNS request
Connection attempt
Stealing user critical data
Unauthorized injection to a recently created process by asynchronous procedure call
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-29T00:41:00Z UTC
Last seen:
2026-08-10T07:03:00Z UTC
Hits:
~1000
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Threat name:
ByteCode-MSIL.Spyware.Noon
Status:
Malicious
First seen:
2026-06-29 03:47:55 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 36 (72.22%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
DumpBrowserSecrets
PhantomStealer
Result
Malware family:
phantom_stealer
Score:
10/10
Tags:
family:phantom_stealer collection credential_access discovery spyware stealer
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Uses browser remote debugging
Family: PhantomStealer
Unpacked files
SH256 hash:
afa95f8089310841b669215cc5b699fe05c7560dc2e180387e60a129a91cdd7b
MD5 hash:
08d04806a27d83a5d32663b1f0066701
SHA1 hash:
b1509998859103b3a828951ff971f6f4f67cf4b9
SH256 hash:
c934a2db58a1a64ee245a7627843508c6c517fcb06ea6855d26a72b41ae6753b
MD5 hash:
0e51138ef195ac755f052babb761a1e7
SHA1 hash:
3c7bbeabc56110d3463e6002cd0ff5c9a168d64b
SH256 hash:
b0935270bc8ed6d31c5352c49a8f5d7cbe62457133fe1cf7effeeeb1440e9ce0
MD5 hash:
f8c81aac564cf5834e602553a19c17a0
SHA1 hash:
bee29ea3fe90c45bab11b2bf941fbbcbc6acbbf9
SH256 hash:
3f53c9b7b3d9655bef339d9107865ea1dbe4ca60d7299be6f9794a167800325c
MD5 hash:
ceb195dd3cfbd4b8c8167604c06cda75
SHA1 hash:
8d26735771bb5b23111e00e0c7f6072a7564e473
SH256 hash:
f1b0b1e523f8a40865d86e095996ec24e4ce8901e679ac2f981ca3fe56fb068a
MD5 hash:
a655d1852b9a570ec18f3255641f9fb9
SHA1 hash:
93094bc50b979038fd215efbc7341d492b0b4f55
SH256 hash:
1c5f4e2f6d71f6a7f03c299c4fac8b299f6041c723d24f74b3f958985362c474
MD5 hash:
ae73b020ede63f7305758e015f8db180
SHA1 hash:
aae9a282a7e70290867d53ef214f70730056ff78
Detections:
triage_net_infostealer_wsh
triage_vidar_infostealer
Malware family:
PhantomStealer
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.