MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PhantomStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 25 File information Comments

SHA256 hash:	cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63
SHA3-384 hash:	959f0d830cc5a6dd3466fa21f7b62c99b7f42457f5ea37b6f364f7cdd34c322cb07d45f643c47f7df340116dfab7017d
SHA1 hash:	16923c81ff9564b8a16070e3c9dc51941711fc47
MD5 hash:	dc9792fe7d61fa3861ce3f5ffa8278e2
humanhash:	tennessee-london-eleven-whiskey
File name:	Posco New Order.exe
Download:	download sample
Signature	PhantomStealer Create hunting rule
File size:	1'795'584 bytes
First seen:	2026-02-25 14:32:39 UTC
Last seen:	2026-02-25 15:21:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'818 x AgentTesla, 19'741 x Formbook, 12'286 x SnakeKeylogger)
ssdeep	24576:TlLoRymbJ8wgMh4CEv3ksjU6UsHMcrE0Jv3oqv5BYg9AxMkD/zfp:tajbOhMhjE/7xUsHtJv3sxMQ
Threatray	274 similar samples on MalwareBazaar
TLSH	T14A85F12037E94A44F4FE5B78457246105BF9FC0BAE32DA1E6E8420DE1D79F418AA1B73
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe PhantomStealer

Intelligence

File Origin

# of uploads :

# of downloads :

161

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Hectobmp

Details

Link:

https://research.acce.ciphertechsolutions.com/results/c8826de3-a4e9-4816-888c-4c62136186a8/

Malware family:

n/a

ID:

File name:

_cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63.exe

Verdict:

Malicious activity

Analysis date:

2026-02-25 14:34:55 UTC

Tags:

stealer phantom crypto-regex netreactor

Link:

https://app.any.run/tasks/50e11501-8253-42fc-ba3b-2f578a9e1aa1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/54579/

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.82271663.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699f083c8fffa866e3b21109

Tags:

virus remo

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Connection attempt

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file in the %temp% subdirectories

Verdict:

Malicious

Labled as:

Jalapeno.Generic

Link:

https://www.hybrid-analysis.com/sample/cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63

Verdict:

Malicious

File Type:

exe x32

Detections:

Trojan-PSW.Win32.Stealer.sb Trojan-PSW.MSIL.Discord.sb Trojan-PSW.MSIL.Agent.sb Trojan.MSIL.Inject.sb PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Disco.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Stealerium.sb Trojan-PSW.MSIL.Stealer.sb Trojan.MSIL.Inject.b HEUR:Trojan-PSW.MSIL.Stealerium.gen

Link:

https://opentip.kaspersky.com/cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/49190091-c9cd-46d6-ad37-d74cc8a956e5

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86

Link:

https://app.malva.re/file/dc9792fe7d61fa3861ce3f5ffa8278e2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63/

Verdict:

Malicious

Threat:

Family.PHANTOM

Link:

https://tip.neiki.dev/file/cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63

Threat name:

Win32.Trojan.Jalapeno

Status:

Malicious

First seen:

2026-02-20 02:24:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 36 (52.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=z54qtagrtluunvw6nibradwbyid4574vz57cedmqccgcosp5b5rq._file

Verdict:

malicious

Label(s):

purecrypter

phantomstealer

PhantomStealer

66158410eadaa76f6a183087c95b694a1404641be3a16b3b704f4cd56e53f20c

PhantomStealer

78826700c53185405a0a3897848ca8474920804a01172f987a18bd3ef9a4fc77

PhantomStealer

b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c

PhantomStealer

d52c6f80a2f8b77133d238743c79aca4554ba5f404e109a93ff9c2db115bd873

PhantomStealer

dbbb1c1ad17996d18e3e28537e0188b204657e87b8cb495e05bdb36c75cae466

PhantomStealer

ec5b91ad14060b955dec4c1fcd63be9d63d66185d463ea785e5f888eee460f0b

PhantomStealer

+ 264 additional samples on MalwareBazaar

Result

Malware family:

phantom_stealer

Score:

10/10

Tags:

family:phantom_stealer collection discovery persistence spyware stealer

Link:

https://tria.ge/reports/260225-rw2p4aaw9f/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

.NET Reactor proctector

Reads user/profile data of web browsers

Detects PhantomStealer payload

PhantomStealer

Phantom_stealer family

Unpacked files

SH256 hash:

cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63

MD5 hash:

dc9792fe7d61fa3861ce3f5ffa8278e2

SHA1 hash:

16923c81ff9564b8a16070e3c9dc51941711fc47

Link:

https://www.unpac.me/results/f9ac20c2-cb0b-4ffe-b9da-329fe0287f88/

SH256 hash:

18bf646fad26a0aa1264cac867789c6d9f4de762bc83b9aeeff0f8d8d48ee6ac

MD5 hash:

4faf9d90e22fe6f5452ab806bb763ed7

SHA1 hash:

564455391f73d9d8f3baf3b907dfb9723f249820

Link:

https://www.unpac.me/results/f9ac20c2-cb0b-4ffe-b9da-329fe0287f88/

SH256 hash:

a6a6cf76c8a7dd497424f636ddaa9c58a77971f9b267b257f1906c0388c281d6

MD5 hash:

f0ff6d188e5191a7295ae1e852259e7d

SHA1 hash:

c3f1b28ff5806069dc6b694eb2c40af6bdc27078

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

INDICATOR_EXE_Packed_DotNetReactor

Link:

https://www.unpac.me/results/f9ac20c2-cb0b-4ffe-b9da-329fe0287f88/

Parent samples :

24d6cbd8f4eb920651f82adb1288cd4d5227f6bcd8fe71341ebdeb434bbfae01
b430b6d8ffe30bb994eb58e11cab86092452755f0044acba6de4ef305f8fc28c
6f998e066e89d74f97f68b8b300cbf96f10df8bca0f96b78082e54ae578c6808
dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042
787603ed370b21f4b0c042915f7fec0e3ad9f1a74f9bea21a99f9e7a5232a31c
cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63
24a07efb7c95800b89d34683abe09cf8e7d7776483f586abca769c2f98bb67c6
5524f65612afc339bd726ce2d20c9b8040a2137c7c23d8b68c47fe35a02c616d

SH256 hash:

69b83d39655ef00f775e5bc22b91874d629e68319550000343c581318fbe6fd4

MD5 hash:

b02d83e8ecf71c6399a3b3be638fb93b

SHA1 hash:

dfaff9ecb5aeab521334bf05aa7832d3d9af9451

Link:

https://www.unpac.me/results/f9ac20c2-cb0b-4ffe-b9da-329fe0287f88/

SH256 hash:

02711d90750e570091ac79124658c5f304cf2f70e9234b3251854a425bec78cc

MD5 hash:

cdd74e2ba1d50150f5decce776c131b4

SHA1 hash:

fffd3167bb5b476fdab269c05f581dc379be255f

Detections:

phantom_stealer

cn_utf8_windows_terminal

INDICATOR_EXE_Packed_Fody

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Link:

https://www.unpac.me/results/f9ac20c2-cb0b-4ffe-b9da-329fe0287f88/

Parent samples :

4c3ae6b27ff6c7003f1d58a9c09f69c6a877f5db5b285abe919ff41e1654c6bc
abf4b038965806a304b371cec0afde2312895ebadc36aba7f037096ad16d66f5
cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63

Malware family:

PhantomStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cf790980d19a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_EXE_Packed_Fody Create hunting rule
Author:	ditekSHen
Description:	Detects executables manipulated with Fody

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM names

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM usernames

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon Create hunting rule
Author:	ditekSHen
Description:	Detects executables with interest in wireless interface using netsh

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	Windows_Generic_Threat_f57e5e2a Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Xeno_89f9f060 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

PhantomStealer

exe cf790980d19ae946d6de6a03100ec1c207ceff95cf7e220d90108c2749fd0f63

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/54579/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample