🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425
SHA3-384 hash: 769cc06b04a05eb23c4b7f15a062f4c683189931d7a03e293e38664d4306faafec91af7f6974fc14ca9b9b919b4a25c8
SHA1 hash: cbf8d1ea680cbc6111890f620f569cb5a03c2495
MD5 hash: e45a8d4eaedda431f00fda0c1097ff31
humanhash: skylark-mars-vegan-colorado
File name:e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'503'744 bytes
First seen:2026-06-08 09:51:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'692 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 24576:0TEr1IHfxEmxD6kFos6vmdYsIWVpeCyBLps7rvyHJh28fBUcY486pE:XImmxD1YsIWVgRBEraHr5fWcY488E
Threatray 646 similar samples on MalwareBazaar
TLSH T1976523144A25D522CAE34BB59B21E77D13391E5CE902D3AF4FFEACEB305A174B818391
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 2060e16cdcce8e06 (9 x Formbook, 1 x a310Logger, 1 x AsyncRAT)
Reporter adrian__luca
Tags:exe PhantomStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1b4724ab-8f9d-4172-bcde-3aeede74cdcf/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69951/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2690e3ae2f98c00a68cd5e
Tags:
redline emotet spam
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
darkcloud packed vbnet
Link:
https://www.filescan.io/uploads/6a2690b23d2a0c6df8e96a06/reports/7c5d4c5f-0793-4194-9e97-7c16df7bb89f/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-18T02:42:00Z UTC
Last seen:
2026-06-10T08:39:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cfe486ed-e5f2-4588-aa5f-830523e3f3e7
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425/
Threat name:
ByteCode-MSIL.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2026-05-18 05:19:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
phantomstealer
Create hunting rule
Similar samples:
191dd7079969ccb6ce15556059be86747df67a252bf27905aebb8e0e803f9926
PhantomStealer
2a86c8ae8cabbeb5909a0240fef9bd50fbf422f9d3d6a54c4a4e5c255dae3ddf
PhantomStealer
6314c3c82acb165b93aa922ff379754ea29c321d7a757a5d55d72e537072d9c7
PhantomStealer
9fc4da23cd58e6a0c093804a0b64886e8f5a41e2003a79dde49dc3c762da5bde
PhantomStealer
d8a05deefe97c6bbe1e083e9d8a182e6b6e5fbc77af483d2cdef0b4cadec22ce
PhantomStealer
dcbc11334c0273afead141a14c127662e1caa06bc6ba0b119d1bbc67d1f0e148
PhantomStealer
error
PhantomStealer
f09a097b958bc565b990c17bb42765b488386fc2803a41872296db6923f09c32
PhantomStealer
+ 636 additional samples on MalwareBazaar
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260608-lvssxacv61/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Detects PhantomStealer written in C#
Family: PhantomStealer
Unpacked files
SH256 hash:
e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425
MD5 hash:
e45a8d4eaedda431f00fda0c1097ff31
SHA1 hash:
cbf8d1ea680cbc6111890f620f569cb5a03c2495
Link:
https://www.unpac.me/results/68364fda-eb44-45c4-9b4b-63adcf0dad50/
SH256 hash:
a8e9af5d5db01b452944e83f445f25e3d3d04275127f12f8c368053b23c58694
MD5 hash:
a9e32f0739d267f3ba035595a0a1558c
SHA1 hash:
13db8d9b4a34689ef263de6734dc38bb58f7f795
Link:
https://www.unpac.me/results/68364fda-eb44-45c4-9b4b-63adcf0dad50/
SH256 hash:
1a1409b24138763343d8fa22654b7cdd8af0ee3a81505f23a733c1de20a13953
MD5 hash:
ea086b36fe0eab7a1f9904681c32f9b2
SHA1 hash:
261916a7b7991d5833746a801196a5fdf70247df
Link:
https://www.unpac.me/results/68364fda-eb44-45c4-9b4b-63adcf0dad50/
SH256 hash:
92c540aa9e4b579bd2c6a5b17f5b0adf31d63f367017cda95a94de539e65dd18
MD5 hash:
81a5ea8e0fcb9227996038fcce592723
SHA1 hash:
c157d08be226499a717d101bfbfa0d2a1e7c0662
Detections:
phantom_stealer
Create hunting rule
Link:
https://www.unpac.me/results/68364fda-eb44-45c4-9b4b-63adcf0dad50/
Parent samples :
1fe20f1ffd40e292837f4401f094e9d830874ae46f7a036ec66d5e720edf18a9
c5c29720693314c6492a45268a4852d5c6efb4698d928ac6f68c283ea7c9f785
5d23a0e4656f41bcb064307a614565b32cf6d04d6b38a910f24570907f29b436
db0864b36e22c383e8e59b8d2d4610276ab4bbd97d7b382bdb451fb7ed9a6540
420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89
d6168fea1d549e10df9f33d41a6058573f32312eb67b1cc48756dca2558479ca
7c26003b25a03f34ac2ddd11324d2501506ef7fa694cac3ec9d63717d3071783
e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425
863e5790dc76c8ef082144e1f7ed91e92cb72960172b56af593737c738cfc8f5
c6f8729d491286d2deaa843edd031cd48e735b9c4963825d94b53a2bec084be4
985059c645fa9b5ad5b804ab23f6d023bb5a324d66677bac0b4a43ee1f5496a6
fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef
Malware family:
PhantomStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e7096f11b4ea/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69951/

Comments