MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8e12547b133a5a056170a5ecdbc3d9b4db273ca92091ef3052ad0b911d00b33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8e12547b133a5a056170a5ecdbc3d9b4db273ca92091ef3052ad0b911d00b33
SHA3-384 hash: 495c1f76ed62691f9ada30d20befb63f7435776d1ec28d499c6f726109a07368b756290380d4b1e2affe5821a9e52162
SHA1 hash: 3ac8ccb54fe0cda9e9a77e0532f614a06254277d
MD5 hash: d98c59b734f1f8c21ece429bfd8c252e
humanhash: vermont-seven-december-salami
File name:SWIFT Mesaji - 2179GKGD26002283.js
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:6'819'698 bytes
First seen:2026-08-05 08:06:10 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:Vk+bmjl36q7tTlgJraxRuFLza403V4UFzMmbi95FW6KPEbfMGl5WGFzaT/dQDPRS:i+bmjl36qZ
TLSH T1F966D9E763EE34091A28376D980D69048F6AD4505EC3B6D8B4EF0EC8574EDA772E047B
Magika javascript
Reporter abuse_ch
Tags:js PhantomStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
repaired
Link:
https://www.filescan.io/uploads/6a72ef127bb7fba3cab84546/reports/4c565595-e7fb-4748-9249-eb6518902392/overview
Verdict:
Malicious
Labled as:
Trojan/JS.Obfuscated
Link:
https://www.hybrid-analysis.com/sample/e8e12547b133a5a056170a5ecdbc3d9b4db273ca92091ef3052ad0b911d00b33
Verdict:
Malicious
File Type:
js
First seen:
2026-08-05T00:44:00Z UTC
Last seen:
2026-08-07T04:32:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/e8e12547b133a5a056170a5ecdbc3d9b4db273ca92091ef3052ad0b911d00b33/results?tab=lookup
Result
Threat name:
KeyLogger, MicroClip, Phantom stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1952518
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Early bird code injection technique detected
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
JavaScript file contains suspicious strings
JavaScript source code contains functionality to generate code involving a shell, file or stream
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious Child Process of AspNetCompiler
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Keylogger Generic
Yara detected MicroClip
Yara detected Phantom stealer
Yara detected Powershell decode and execute
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1952518 Sample: SWIFT Mesaji - 2179GKGD2600... Startdate: 05/08/2026 Architecture: WINDOWS Score: 100 77 api.telegram.org 2->77 79 icanhazip.com 2->79 89 Suricata IDS alerts for network traffic 2->89 91 Found malware configuration 2->91 93 Malicious sample detected (through community Yara rule) 2->93 97 15 other signatures 2->97 11 wscript.exe 2 4 2->11         started        14 powershell.exe 19 2->14         started        16 powershell.exe 11 2->16         started        18 3 other processes 2->18 signatures3 95 Uses the Telegram API (likely for C&C communication) 77->95 process4 signatures5 129 Suspicious powershell command line found 11->129 131 Wscript starts Powershell (via cmd or directly) 11->131 133 Creates autostart registry keys with suspicious values (likely registry only malware) 11->133 135 4 other signatures 11->135 20 powershell.exe 16 11->20         started        23 conhost.exe 14->23         started        25 aspnet_compiler.exe 14->25         started        27 aspnet_compiler.exe 14->27         started        37 3 other processes 14->37 29 conhost.exe 16->29         started        31 conhost.exe 18->31         started        33 conhost.exe 18->33         started        35 conhost.exe 18->35         started        process6 signatures7 113 Writes to foreign memory regions 20->113 115 Found suspicious powershell code related to unpacking or dynamic code loading 20->115 117 Injects a PE file into a foreign processes 20->117 39 aspnet_compiler.exe 16 7 20->39         started        44 aspnet_compiler.exe 20->44         started        46 conhost.exe 20->46         started        48 4 other processes 20->48 process8 dnsIp9 85 api.telegram.org 149.154.166.110, 443, 49731 TELEGRAMVG United Kingdom 39->85 87 icanhazip.com 104.16.185.241, 49730, 80 CLOUDFLARENET-CloudflareIncUS Canada 39->87 73 C:\Users\user\AppData\...\aspnet_compiler.exe, PE32 39->73 dropped 75 C:\Users\user\...\DumpBrowserSecrets.exe, PE32+ 39->75 dropped 119 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 39->119 121 Tries to steal Mail credentials (via file / registry access) 39->121 123 Found many strings related to Crypto-Wallets (likely being stolen) 39->123 125 Creates multiple autostart registry keys 39->125 50 DumpBrowserSecrets.exe 14 39->50         started        54 DumpBrowserSecrets.exe 39->54         started        127 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 44->127 file10 signatures11 process12 file13 71 C:\Users\...\DllExtractChromiumSecrets.dll, PE32+ 50->71 dropped 99 Antivirus detection for dropped file 50->99 101 Multi AV Scanner detection for dropped file 50->101 103 Early bird code injection technique detected 50->103 105 Queues an APC in another process (thread injection) 50->105 56 chrome.exe 50->56         started        58 conhost.exe 50->58         started        60 msedge.exe 50->60         started        107 Tries to harvest and steal browser information (history, passwords, etc) 54->107 109 Writes to foreign memory regions 54->109 111 Allocates memory in foreign processes 54->111 62 conhost.exe 54->62         started        64 chrome.exe 54->64         started        66 msedge.exe 54->66         started        signatures14 process15 process16 68 chrome.exe 56->68         started        dnsIp17 81 www.google.com 142.251.150.119, 443, 49718, 49729 GOOGLE-GoogleLLCUS United States 68->81 83 142.251.157.119, 443, 49722, 49728 GOOGLE-GoogleLLCUS United States 68->83
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e8e12547b133a5a056170a5ecdbc3d9b4db273ca92091ef3052ad0b911d00b33
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8e12547b133a5a056170a5ecdbc3d9b4db273ca92091ef3052ad0b911d00b33/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-05 03:37:40 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 24 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5dqskr5rgos2avqxbjpm3pb5tng3e46ksier54yfflilseoqbmzq._file
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection credential_access discovery execution persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/260805-jzqs1aga66/
Behaviour
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Checks processor information in registry
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Creates a file in the Startup directory
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Uses browser remote debugging
Family: PhantomStealer
Malware Config
C2 Extraction:
https://api.telegram.org/bot8873845569:AAF3byWhncZulxEoZzW3k_b3t_LXADS0iMI/sendMessage?chat_id=7085914952
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e8e12547b133a5a056170a5ecdbc3d9b4db273ca92091ef3052ad0b911d00b33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments