MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2e9a17cf13e7ba5044d0f53a2d7fa15dafe298a81b060169acf39ae78095cc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e2e9a17cf13e7ba5044d0f53a2d7fa15dafe298a81b060169acf39ae78095cc2
SHA3-384 hash:	7d83d6ebdfe76d8a508c2fc7139a50b872c854ff8e601037c9f9b8e857bc538fe27f1cca3cc51c99fcd9dd05bbaae0fc
SHA1 hash:	0a6dc447f38dd17adb8cea2e1a244eb202b58b40
MD5 hash:	ef85feb674330f7268e5a561d5f9c9c5
humanhash:	sink-mobile-saturn-crazy
File name:	rRequestforQuotation-RFQ20260127_CommercialList.bat
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	5'444 bytes
First seen:	2026-01-27 08:00:07 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	96:z5JsHsW7wtCNTnFk9JL7XDAgSqWURYas5NLJvgHHm7lW7fBpP8y4C:z5JsHs+ICNCF7zWqWURg5NFUG7E7f3PP
TLSH	T12AB11823ED8E862F0F0E32FB1B38546304B19964E3330D753458E9B985D4490F2DB639
Magika	csv
Reporter	FXOLabs
Tags:	bat PhantomStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

62

Origin country :

BR

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN guloader

Malware family:

guloader

Alert

Create hunting rule

ID:

1

File name:

_ec10779d63738e2f5a3e1ea22dd576a7a4e390bff91814b46241f9df3d961335.rar

Verdict:

Malicious activity

Analysis date:

2026-01-27 07:32:34 UTC

Tags:

arch-exec guloader loader

Link:

https://app.any.run/tasks/a1f3de81-8a34-4ec6-af26-434dc649bbc8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/50350/

CyberFortress Clean

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=697869c9bec9764f452f3033

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 obfuscated powershell

Link:

https://www.filescan.io/uploads/697870b84156786ccbd9abb2/reports/a98167ed-a5d9-4bbb-9ef9-394646b41f70/overview

Hybrid Analysis BAT/Agent.ATL7.gen

Verdict:

Suspicious

Labled as:

BAT/Agent.ATL7.gen

Link:

https://www.hybrid-analysis.com/sample/e2e9a17cf13e7ba5044d0f53a2d7fa15dafe298a81b060169acf39ae78095cc2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-01-27T01:14:00Z UTC

Last seen:

2026-01-29T06:32:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan.Script.Generic HEUR:Trojan.BAT.Obfuscated.gen

Link:

https://opentip.kaspersky.com/e2e9a17cf13e7ba5044d0f53a2d7fa15dafe298a81b060169acf39ae78095cc2/results?tab=lookup

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e2e9a17cf13e7ba5044d0f53a2d7fa15dafe298a81b060169acf39ae78095cc2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e2e9a17cf13e7ba5044d0f53a2d7fa15dafe298a81b060169acf39ae78095cc2/

Neiki Family.GULOADER

Verdict:

Malicious

Threat:

Family.GULOADER

Link:

https://tip.neiki.dev/file/e2e9a17cf13e7ba5044d0f53a2d7fa15dafe298a81b060169acf39ae78095cc2

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.GuLoader

Threat name:

Script-PowerShell.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-01-27 04:51:12 UTC

File Type:

Text

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4lu2c7hrhz52kbcnb5j2fv72cxnp4kmkqgygafu2z44246ajltba._file

Hatching Triage phantom_stealer

Result

Malware family:

phantom_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:guloader family:phantom_stealer collection discovery downloader execution persistence stealer

Link:

https://tria.ge/reports/260127-jwhyzsgw2c/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Detects PhantomStealer payload

Guloader family

Guloader,Cloudeye

PhantomStealer

Phantom_stealer family

VMRay PhantomStealer

Malware family:

PhantomStealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e2e9a17cf13e/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e2e9a17cf13e7ba5044d0f53a2d7fa15dafe298a81b060169acf39ae78095cc2

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

PhantomStealer

bat e2e9a17cf13e7ba5044d0f53a2d7fa15dafe298a81b060169acf39ae78095cc2

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/50350/