MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392
SHA3-384 hash: c39bbaaca361e6c48cf2b9dc2b0b088ad5ccdeef42b78279e42dbbaf29024ef8d2a652e882cbebfa4c547c6326c56312
SHA1 hash: 6d9367c6a7ed64992996412f59fd09b273334578
MD5 hash: a707e79e2eebffb298ed7aad729c8e29
humanhash: california-lactose-angel-delta
File name:OAAAA.vbs
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:5'977'942 bytes
First seen:2025-10-07 18:34:47 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 192:Mr1GAbEdURa6M2FVEdLDG6VeNzFw0ZD164999APl/9Z6Qm6bON+Swmmmmmmmmmmi:AVEgFjE5Vw4yyFmmmmmmmmmmmmmLEo9
Threatray 63 similar samples on MalwareBazaar
TLSH T11D5692BED1E01AE8B2A80834F6772D345B47FD30527ED6A624938DFF67104061D9A2B7
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika gzip
Reporter abuse_ch
Tags:PhantomStealer vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
49
Origin country :
SE SE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/31025/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e55e1f7f305fa2545d5b64
Tags:
autorun dropper shell sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 evasive obfuscated powershell
Link:
https://www.filescan.io/uploads/68e55e8c5a3bccf09ebbf1f4/reports/1f9e5bb0-a66b-4695-b61c-85515cc7edb8/overview
Verdict:
Malicious
Labled as:
GT:VB.Honolulu.1
Link:
https://www.hybrid-analysis.com/sample/decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392
Verdict:
Malicious
File Type:
unknown
First seen:
2025-10-07T08:31:00Z UTC
Last seen:
2025-10-08T09:19:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392/results?tab=lookup
Result
Threat name:
Phantom stealer, Strela Stealer
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1790871
Signature
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
AI detected malicious Powershell script
Allocates memory in foreign processes
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Encrypted powershell cmdline option found
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies existing user documents (likely ransomware behavior)
Monitors registry run keys for changes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Silenttrinity Stager Msbuild Activity
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected Phantom stealer
Yara detected Powershell download and execute
Yara detected Strela Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1790871 Sample: OAAAA.vbs Startdate: 07/10/2025 Architecture: WINDOWS Score: 100 127 pastebin.com 2->127 129 api.telegram.org 2->129 131 10 other IPs or domains 2->131 153 Suricata IDS alerts for network traffic 2->153 155 Found malware configuration 2->155 157 Malicious sample detected (through community Yara rule) 2->157 163 27 other signatures 2->163 13 wscript.exe 1 2->13         started        16 powershell.exe 2->16         started        18 powershell.exe 2->18         started        20 3 other processes 2->20 signatures3 159 Connects to a pastebin service (likely for C&C) 127->159 161 Uses the Telegram API (likely for C&C communication) 129->161 process4 signatures5 205 Suspicious powershell command line found 13->205 207 Wscript starts Powershell (via cmd or directly) 13->207 209 Uses schtasks.exe or at.exe to add and modify task schedules 13->209 213 2 other signatures 13->213 22 powershell.exe 7 13->22         started        25 schtasks.exe 1 13->25         started        27 schtasks.exe 1 13->27         started        29 wscript.exe 16->29         started        31 conhost.exe 16->31         started        33 wscript.exe 18->33         started        35 conhost.exe 18->35         started        211 Wscript called in batch mode (surpress errors) 20->211 37 conhost.exe 20->37         started        39 3 other processes 20->39 process6 signatures7 167 Suspicious powershell command line found 22->167 169 Found many strings related to Crypto-Wallets (likely being stolen) 22->169 171 Encrypted powershell cmdline option found 22->171 175 3 other signatures 22->175 41 powershell.exe 14 18 22->41         started        45 conhost.exe 22->45         started        47 conhost.exe 25->47         started        49 conhost.exe 27->49         started        173 Wscript starts Powershell (via cmd or directly) 29->173 51 powershell.exe 29->51         started        54 powershell.exe 33->54         started        process8 dnsIp9 139 dpaste.org 104.20.36.119, 443, 49691, 49693 CLOUDFLARENETUS United States 41->139 141 pastebin.com 172.66.171.73, 443, 49690, 49692 CLOUDFLARENETUS United States 41->141 121 C:\Users\user\AppData\Local\Temp\nAvER.ps1, Unicode 41->121 dropped 56 powershell.exe 15 41->56         started        165 Wscript called in batch mode (surpress errors) 51->165 60 conhost.exe 51->60         started        62 wscript.exe 51->62         started        64 conhost.exe 54->64         started        66 wscript.exe 54->66         started        file10 signatures11 process12 file13 117 __________________...________-------.lnk, MS 56->117 dropped 119 C:\Users\user\AppData\Local\Temp\xx2.vbs, ASCII 56->119 dropped 197 Found many strings related to Crypto-Wallets (likely being stolen) 56->197 199 Writes to foreign memory regions 56->199 201 Injects a PE file into a foreign processes 56->201 68 MSBuild.exe 16 107 56->68         started        73 powershell.exe 23 56->73         started        75 MSBuild.exe 56->75         started        77 2 other processes 56->77 signatures14 process15 dnsIp16 133 ftp.tetraatech.com 199.188.201.183, 21, 49759 NAMECHEAP-NETUS United States 68->133 135 api.telegram.org 149.154.167.220, 443, 49754, 49757 TELEGRAMRU United Kingdom 68->135 137 icanhazip.com 104.16.184.241, 49756, 49758, 80 CLOUDFLARENETUS United States 68->137 109 C:\Users\user\AppData\...\ZQIXMVQGAH.pdf, ASCII 68->109 dropped 111 C:\Users\user\AppData\...\VAMYDFPUND.docx, ASCII 68->111 dropped 113 C:\Users\user\AppData\...\UOOJJOZIRH.docx, ASCII 68->113 dropped 115 3 other files (2 malicious) 68->115 dropped 177 Tries to steal Mail credentials (via file / registry access) 68->177 179 Creates multiple autostart registry keys 68->179 181 Tries to harvest and steal browser information (history, passwords, etc) 68->181 189 5 other signatures 68->189 79 firefox.exe 68->79         started        81 msedge.exe 68->81         started        84 chrome.exe 68->84         started        89 10 other processes 68->89 183 Loading BitLocker PowerShell Module 73->183 86 powershell.exe 1 11 73->86         started        185 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 75->185 187 Switches to a custom stack to bypass stack traces 75->187 file17 signatures18 process19 dnsIp20 91 firefox.exe 79->91         started        123 192.168.2.5, 138, 21, 443 unknown unknown 81->123 125 239.255.255.250 unknown Reserved 81->125 95 msedge.exe 81->95         started        97 setup.exe 81->97         started        99 msedge.exe 81->99         started        101 msedge.exe 81->101         started        191 Creates autostart registry keys with suspicious values (likely registry only malware) 86->191 193 Creates autostart registry keys with suspicious names 86->193 195 Creates multiple autostart registry keys 86->195 signatures21 process22 dnsIp23 143 prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216, 443, 49701 GOOGLEUS United States 91->143 145 127.0.0.1 unknown unknown 91->145 203 Monitors registry run keys for changes 91->203 103 firefox.exe 91->103         started        105 firefox.exe 91->105         started        147 part-0013.t-0009.fb-t-msedge.net 13.107.226.41, 443, 49718 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 95->147 149 13.107.253.41, 443, 49731, 49732 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 95->149 151 37 other IPs or domains 95->151 107 setup.exe 97->107         started        signatures24 process25
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392/
Verdict:
Malicious
Threat:
Family.PHANTOMSTEALER
Link:
https://tip.neiki.dev/file/decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-10-07 15:20:10 UTC
File Type:
Binary
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=33f7i2xivw4wt5xpj6kag7kerte4xwi2c2mmvadnfvt4vys46oja._file
Verdict:
malicious
Label(s):
xenostealer
Create hunting rule
Similar samples:
03211407b165e3d6fbd3f1bb59c2e20b506e6cfae4c7424592e7d1cc7c564fbd
PhantomStealer
122ce2c88c8be8e67efafc15d1458811c6b052a315cc4e75e8f0f050859fce47
PhantomStealer
17440815b289ab03ed1a2906514a94940a12f2270ec5e39c819d786fd36349c4
PhantomStealer
56014a5ec7d4be83b5fbe439b9142654a267619981184bb757fb325edd4f3b08
PhantomStealer
57a71e4d5ce81f7931e9f9814b2ba93127f3238d76afcb7ece25d27dbd3d5d12
PhantomStealer
58ba838860f2baa915c2e0e3a310c9695084d58fdd8cc95c4723ffef84c472a1
PhantomStealer
9ab1f8c899ca80bc87d8fbefbe1dab97af2fd3f2eace0b35cbdbfd5dfb19f32d
PhantomStealer
c1ae0a9f22462a83d0c1649fa5dfcd32527172bf8ca14fda22f31c77a9e6512e
PhantomStealer
error
PhantomStealer
+ 53 additional samples on MalwareBazaar
Result
Malware family:
phantomstealer
Create hunting rule
Score:
  10/10
Tags:
family:phantomstealer collection defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/251007-xayzza1pt4/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Hide Artifacts: Hidden Window
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Phantomstealer family
Malware Config
C2 Extraction:
https://api.telegram.org/bot7724523460:AAHngsin_-PJwm0YyvNGNJmdFr6kneFLhBU/sendMessage?chat_id=7571756559
Dropper Extraction:
https://pastebin.com/raw/jgKWLc0S
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames
Create hunting rule
Author:ditekSHen
Description:Detects executables containing possible sandbox analysis VM names
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
Create hunting rule
Author:ditekSHen
Description:Detects executables containing possible sandbox analysis VM usernames
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon
Create hunting rule
Author:ditekSHen
Description:Detects executables with interest in wireless interface using netsh
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Generic_Threat_f57e5e2a
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Xeno_89f9f060
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31025/

Comments