🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811
SHA3-384 hash: 34c0e6926c94c47849b279018e1894eff935ec9ee53aa9459156e81782650e7c09a2886301d25f2776bf1ec3c1b2009e
SHA1 hash: 356d86190ea0bb0241b1f3abd444b2a621a0d3f6
MD5 hash: b9945d2b89309cccb353330ebe8cb0ad
humanhash: fruit-michigan-jig-winner
File name:RFQ-SABIC FACTORY-MEDUYW342685-20250528170802-Specification.bat
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'111'612 bytes
First seen:2026-03-11 08:53:52 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 12288:h5Ut5OddiwQj5TuhYtTfDdsRNYknvvRLHoHelmfoX2afCLLVrICBCa1ti5vXLAGO:h5C+dRQjZ+YZDORNBJIH5oXiLLn/tGil
Threatray 403 similar samples on MalwareBazaar
TLSH T1943502158DC46FB5CFAC6A1880FE1A1E63A04B9E402B798DEB33BD46AFF7544410B1D9
Magika batch
Reporter lowmal3
Tags:bat PhantomStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d00bc67c-3d55-4555-bf70-d62bbd92bfe2/
Malware family:
n/a
ID:
1
File name:
ddf3de37d10e3b2f29056abbf10db5123815328f1508ebb30614788ccaf2b86c.zip
Verdict:
No threats detected
Analysis date:
2026-03-10 04:22:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/733e7daa-a77e-4e84-b0cc-56c0bffa342f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/57042/
Detection(s):
SecuriteInfo.com.BAT.Starter.721.26043.20478.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69af9c6ae41a5a099931a6d6
Tags:
vmdetect dropper shell
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm base64 obfuscated
Link:
https://www.filescan.io/uploads/69b12dbd9eaae84659479f90/reports/7bc9ea4a-b99f-4461-92d2-4e7e78f8e4e8/overview
Verdict:
Malicious
Labled as:
TrojWare.BadShell
Link:
https://www.hybrid-analysis.com/sample/ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811
Verdict:
Malicious
File Type:
unix shell
Detections:
Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Stealerium.sb Trojan-PSW.MSIL.Stealer.sb Trojan-PSW.MSIL.Discord.sb Trojan-PSW.MSIL.Agent.sb Trojan.Win32.Shellcode.sb Trojan.PowerShell.Cobalt.sb Backdoor.MSIL.Agent.sb Trojan.PowerShell.Agent.sb HEUR:Trojan.BAT.Cobalt.gen Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb HEUR:Trojan.MSIL.Rozena.gen HEUR:Backdoor.MSIL.Agent.gen
Link:
https://opentip.kaspersky.com/ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1881827
Signature
Bypasses PowerShell execution policy
Compiles code for process injection (via .Net compiler)
Encrypted powershell cmdline option found
Found large BAT file
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1881827 Sample: RFQ-SABIC FACTORY-MEDUYW342... Startdate: 11/03/2026 Architecture: WINDOWS Score: 100 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Found large BAT file 2->49 51 7 other signatures 2->51 9 cmd.exe 1 2->9         started        12 svchost.exe 1 1 2->12         started        process3 dnsIp4 57 Suspicious powershell command line found 9->57 59 Encrypted powershell cmdline option found 9->59 61 Bypasses PowerShell execution policy 9->61 15 cmd.exe 1 9->15         started        18 conhost.exe 9->18         started        43 127.0.0.1 unknown unknown 12->43 signatures5 process6 signatures7 63 Suspicious powershell command line found 15->63 65 Encrypted powershell cmdline option found 15->65 20 powershell.exe 16 15->20         started        24 powershell.exe 30 15->24         started        26 conhost.exe 15->26         started        process8 file9 35 C:\Users\user\AppData\Local\...\critical.ps1, Unicode 20->35 dropped 53 Found suspicious powershell code related to unpacking or dynamic code loading 20->53 55 Compiles code for process injection (via .Net compiler) 20->55 37 C:\Users\user\AppData\Local\...\c3c21sus.0.cs, Unicode 24->37 dropped 39 C:\Users\user\AppData\...\1wpujevy.cmdline, Unicode 24->39 dropped 28 csc.exe 3 24->28         started        31 csc.exe 1 24->31         started        signatures10 process11 file12 41 C:\Users\user\AppData\Local\...\c3c21sus.dll, PE32 28->41 dropped 33 cvtres.exe 1 28->33         started        process13
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811/
Verdict:
Malicious
Threat:
Trojan-PSW.MSIL.Discord
Link:
https://tip.neiki.dev/file/ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811
Threat name:
Script-BAT.Trojan.Donutloader
Create hunting rule
Status:
Malicious
First seen:
2026-03-10 04:22:03 UTC
File Type:
Text (Batch)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zziytq4eshhf7bh6drihej2zwoedfyn733dfzswllghqnp23daiq._file
Verdict:
malicious
Label(s):
phantomstealer
Create hunting rule
donutloader
Create hunting rule
Similar samples:
2a86c8ae8cabbeb5909a0240fef9bd50fbf422f9d3d6a54c4a4e5c255dae3ddf
PhantomStealer
408fbffb330ad289ae8e39bd708a3ccdb55ac31358d4a82ccea4f1c705308c2e
PhantomStealer
57e039b60ff31952018541ae912518263ff5c9f2d5069bb9c7b5f7778cea8de1
PhantomStealer
6314c3c82acb165b93aa922ff379754ea29c321d7a757a5d55d72e537072d9c7
PhantomStealer
80556f89dc73c0363733a728326aa27fab12eba80b9afe18fb7a5fb3d1c5e5f5
PhantomStealer
865bedd407bf055a750c50a398e50cfcbbb7a870a19e5931ac29e81030cc5b17
PhantomStealer
9cbffe3435e4218fbfebedbbc72a2e587098bdd9eb4a4b3014a38d1d9869817b
PhantomStealer
c29966f812a4a6b5db08fc8926aecafaa24395caea1213a8f84da02987a6ff6b
PhantomStealer
c5f8fd48834eb238614b5a3817aeff16510a749d51fc0da922e3b7fcca8c2af7
PhantomStealer
error
PhantomStealer
+ 393 additional samples on MalwareBazaar
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:phantom_stealer collection discovery execution loader persistence stealer
Link:
https://tria.ge/reports/260311-kt2hzsby5r/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
System Time Discovery
Drops file in Windows directory
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Command and Scripting Interpreter: PowerShell
Detects DonutLoader
Detects PhantomStealer written in C#
DonutLoader
Donutloader family
PhantomStealer
Phantom_stealer family
Malware family:
PhantomStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ce5189c38491/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WIN_FileFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects FileFix social engineering technique that launches chained PowerShell and PHP commands from file explorer typed paths
Reference:FileFix social engineering with PowerShell and PHP commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

PhantomStealer

Batch (bat) bat ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/57042/

Comments