MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9c40fa366d3262d2a25e992ec54456ba625c409bffce327857e834b6117557a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d9c40fa366d3262d2a25e992ec54456ba625c409bffce327857e834b6117557a
SHA3-384 hash:	3617de92b07f91669b01952121c53292c40ef8bc0a7aa2d11f253742746cc34724a0c7feeb63a609767efe0bf1db7603
SHA1 hash:	e516125682962ac9c59f31fb76eae86b4bb8e782
MD5 hash:	44eaef7df7ea04ca4cfd8b2897fec12b
humanhash:	avocado-twelve-sixteen-jig
File name:	RFQ-TFPS200.js
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	167'310 bytes
First seen:	2026-08-04 05:08:21 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:xaaX0w6A9iE3LpfJQgk4xb5DvdQRqh8CJOVywk4TftT5a7n1:9XYAUE3Lrk4FpdQwJOMwvTl5ar1
TLSH	T173F3C01463951F30F6A80D9D4D9F188A72FA3602F6215889F6F13DED2F379C85438A9B
Magika	javascript
Reporter	threatcat_ch
Tags:	js PhantomStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

154

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.VBS.Agent.4219.31967.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd conhost exploit lolbin obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/6a7173ff4b00e4fe30c564f7/reports/a43ced67-bee4-49ca-aa6e-b916c7555b5e/overview

Hybrid Analysis HEUR_Trojan_Script_Generic

Verdict:

Malicious

Labled as:

HEUR_Trojan_Script_Generic

Link:

https://www.hybrid-analysis.com/sample/d9c40fa366d3262d2a25e992ec54456ba625c409bffce327857e834b6117557a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-03T16:02:00Z UTC

Last seen:

2026-08-06T03:35:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/d9c40fa366d3262d2a25e992ec54456ba625c409bffce327857e834b6117557a/results?tab=lookup

Joe Sandbox KeyLogger, MicroClip, Phantom stealer, T

Result

Threat name:

KeyLogger, MicroClip, Phantom stealer, T

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.rans.troj.spyw.expl

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1951650

Signature

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Antivirus detection for URL or domain

Contains functionality to log keystrokes (.Net Source)

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Suspicious command line found

Suspicious execution chain found

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Yara detected AntiVM3

Yara detected chromElevator

Yara detected Keylogger Generic

Yara detected MicroClip

Yara detected Phantom stealer

Yara detected Telegram RAT

Yara detected TrojanRansom

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d9c40fa366d3262d2a25e992ec54456ba625c409bffce327857e834b6117557a

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d9c40fa366d3262d2a25e992ec54456ba625c409bffce327857e834b6117557a/

ReversingLabs TitaniumCloud Script-JS.Downloader.RemcosRAT

Threat name:

Script-JS.Downloader.RemcosRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-04 03:23:28 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 24 (45.83%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3hca7i3g2mtc2krf5gjoyvcfnotclrajx76ogj4fp2buwyixkv5a._file

Threatray PhantomStealer

Verdict:

malicious

Label(s):

PhantomStealer

Alert

Create hunting rule

Link:

https://reports.threatray.com/18d0da91-1c43-48ae-b456-ee38a7b4b470

Hatching Triage phantom_stealer

Result

Malware family:

phantom_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:phantom_stealer collection discovery execution persistence stealer

Link:

https://tria.ge/reports/260804-fs9ezs1hnf/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

Family: PhantomStealer

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d9c40fa366d3262d2a25e992ec54456ba625c409bffce327857e834b6117557a