MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dab05de508fb31fe7a4ae0d6a377d386edcdfa2afcad800d042a36cc690e3b9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PhantomStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 3 File information Comments

SHA256 hash:	dab05de508fb31fe7a4ae0d6a377d386edcdfa2afcad800d042a36cc690e3b9e
SHA3-384 hash:	f054063749318172cd8b0c6d9b5002aa892be7cc5dfd3fec3782f6d3705045bb33eca2dfda8609e6b5897fa94ca91728
SHA1 hash:	08169db018f3f16f58af97c2e5cbe5dd7ffc6011
MD5 hash:	dfee2added6d55596e5bfa55fad9ff45
humanhash:	video-may-connecticut-black
File name:	Watch.ps1
Download:	download sample
Signature	PhantomStealer Create hunting rule
File size:	1'045'804 bytes
First seen:	2026-04-29 19:35:52 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	24576:cR47teAwoUck/cnwJW+m2JrCKxbLz01eYOtvYO:+AwomiwxCKWA7tF
Threatray	3'931 similar samples on MalwareBazaar
TLSH	T1A52523605FFAEFAA0FBDC33831BF1E4647D44F978889C9EA40521CA29B53F06856B451
Magika	powershell
Reporter	BastianHein
Tags:	PhantomStealer ps1

Intelligence

File Origin

# of uploads :

# of downloads :

154

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.PowerShell.Packed.244.27424.8033.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

aes base64 crypto encrypted obfuscated

Link:

https://www.filescan.io/uploads/69f25dc186e92bda7017cec5/reports/5cd48c33-7b9d-437d-beee-6c70a7d83ab1/overview

Verdict:

Malicious

Labled as:

DR/SNH

Link:

https://www.hybrid-analysis.com/sample/dab05de508fb31fe7a4ae0d6a377d386edcdfa2afcad800d042a36cc690e3b9e

Verdict:

Malicious

File Type:

ps1

First seen:

2026-04-29T04:04:00Z UTC

Last seen:

2026-04-29T16:54:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.HTA.a PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/dab05de508fb31fe7a4ae0d6a377d386edcdfa2afcad800d042a36cc690e3b9e/results?tab=lookup

Score:

93%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dab05de508fb31fe7a4ae0d6a377d386edcdfa2afcad800d042a36cc690e3b9e

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dab05de508fb31fe7a4ae0d6a377d386edcdfa2afcad800d042a36cc690e3b9e/

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/dab05de508fb31fe7a4ae0d6a377d386edcdfa2afcad800d042a36cc690e3b9e

Threat name:

Script.Dropper.Heuristic

Status:

Malicious

First seen:

2026-04-29 19:36:39 UTC

File Type:

Text (PowerShell)

AV detection:

4 of 24 (16.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3kyf3zii7my746sk4dlkg56tq3w436rk7swyadiefi3my2iohopa._file

Verdict:

malicious

Label(s):

phantomstealer

donutloader

PhantomStealer

6916eee5b360a12e04506e146dbc10b4ff95ba397c4b247b25817600078deac5

PhantomStealer

743c07deb311553d2c40627242b0cf0fa0382f2018b353b24577d0749f3a7ca9

PhantomStealer

75704305538def57efadb10ca26238eb99924705c55c776bb773c558ae9b1b06

PhantomStealer

8a999c3ff175f5de85b7af07af8f9c799a90a55c283d4b47f17d1bd1bba28a87

PhantomStealer

9d49ed07f55c68f2aaa92799afe867420d4d828f2891e4498385a1eb0d90b0e3

PhantomStealer

ad5ade444bb7022dbb9ef78250e22a3991293531062f44b665cf410b128d0850

PhantomStealer

b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32

PhantomStealer

d957bce255b4cd2aa39c40b6e8843b933ed82db3052069b567f685633e15c107

PhantomStealer

error

PhantomStealer

f9a47e24ba812456adc1faa2ce6d48a49e6b1c479b70f7dd9747ec3d2ea12108

PhantomStealer

+ 3'921 additional samples on MalwareBazaar

Result

Malware family:

phantom_stealer

Score:

10/10

Tags:

family:donutloader family:phantom_stealer collection discovery execution loader stealer

Link:

https://tria.ge/reports/260429-ybg9aafw3w/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: PowerShell

System Time Discovery

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Detects DonutLoader

Detects PhantomStealer written in C#

Family: DonutLoader

Family: PhantomStealer

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/dab05de508fb31fe7a4ae0d6a377d386edcdfa2afcad800d042a36cc690e3b9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample