🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7
SHA3-384 hash: 1d9f35bd2d8a23a30359a3ec033c9dcd4686021a00f603f5bcd7f7596f9d60ed470f49e337825b1eb0938b2eb7b0867c
SHA1 hash: f21eb08a59ebd847f76799e8d326d15d2b3f18ea
MD5 hash: a88fcaa7d23546267052d4693631f8ad
humanhash: freddie-tennis-oven-september
File name:PI #65277_SOA 2025-11-11.js
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:2'418'203 bytes
First seen:2025-11-11 13:58:15 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 768:kgBXa/tG0pW441b4Z2e0phOfHe+y9vxv3t7WflsmPfTWpevnDOm7rBT6bDOGscbZ:dZapWfbZ+yVjErWpw7rBT6XlF
Threatray 167 similar samples on MalwareBazaar
TLSH T13AB511A41B4A1D56CBFDB3A95F072C95F261874B1A324828B84CB7C96F3107837F996C
Magika javascript
Reporter James_inthe_box
Tags:exe js PhantomStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27200.JsHeur.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Downloader-24.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Downloader-23.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69134133e2c9ded75d7962bc
Tags:
cryxos spawn virus agent
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 evasive fingerprint obfuscated obfuscated overlay powershell repaired
Link:
https://www.filescan.io/uploads/69134131935d9f0d73cd6547/reports/40186305-c2d0-4f46-a9b9-54ace8178350/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7
Verdict:
Malicious
File Type:
js
First seen:
2025-11-10T21:41:00Z UTC
Last seen:
2025-11-13T12:32:00Z UTC
Hits:
~10000
Detections:
Trojan-PSW.PureLogs.TCP.C&C Trojan.Agentb.TCP.C&C Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7/results?tab=lookup
Score:
7%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
PowerShell
Link:
https://app.malva.re/file/a88fcaa7d23546267052d4693631f8ad
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7/
Verdict:
Malicious
Threat:
Trojan-PSW.PureLogs.TCP
Link:
https://tip.neiki.dev/file/b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7
Threat name:
Script-JS.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2025-11-11 00:46:03 UTC
File Type:
Text (JavaScript)
AV detection:
8 of 23 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wi675gt6a3hbfaa6ibdahsjav3j4n3bbzvdulpxrn4lnubk7p23q._file
Verdict:
malicious
Label(s):
katzstealer
Create hunting rule
Similar samples:
07ac625af6cd4fab9ad10d0c5ceece1cca679452d6e916e14a7e0230e90ebc96
PhantomStealer
0ca7ce88b276ce6eba7b63afc93dc0176c0a58b1869097d0902713903d82a927
PhantomStealer
17ced68461c9666597e1de5d3a69a219ada895e35c382eae83bd3a41918cad78
PhantomStealer
2f5280d0e93ebc9e8e54143216ab0fc87732a9b55594bf743f08af1c25db7ffd
PhantomStealer
36fb537a5abba65f28baf9e87ef8c958cb614c95cb9c31059396eecb21b080bb
PhantomStealer
3c25e04769279d7d83ee4e69084359f635e7ac12f001155b82e6f99085c3e50c
PhantomStealer
b06f81fe6e6e5f7dc716ed8200a7ad5ec8ca222b7c45723d8b4be45bf671ac48
PhantomStealer
error
PhantomStealer
+ 157 additional samples on MalwareBazaar
Result
Malware family:
phantomvai
Create hunting rule
Score:
  10/10
Tags:
family:phantomvai collection discovery execution loader
Link:
https://tria.ge/reports/251111-ragssser9x/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detects PhantomVAI loader aka VMDetectLoader, CaminhoLoader
PhantomVAI, VMDetectLoader, CaminhoLoader
Phantomvai family
Process spawned unexpected child process
Malware Config
Dropper Extraction:
http://archive.org/download/msi-pro-with-b-64_20251021_1736/MSI_PRO_with_b64.png
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b23dfe9a7e06/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b23dfe9a7e06ce12801e404603c920aed3c6ec21cd4745bef16f16da055f7eb7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments