MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f
SHA3-384 hash: 62f59d36c2933340f02a1e2a40c2e1783504712b37a9f537c7766e4ab8cc5fc302296bfe7440005b3d3c1a071522105e
SHA1 hash: 9a44ffb33b4bb3c14d56328c144e098f6cc77b38
MD5 hash: f1557405ac36aa0506b9b7f0df7a680e
humanhash: gee-autumn-bravo-bacon
File name:eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'542'144 bytes
First seen:2026-02-03 16:37:26 UTC
Last seen:2026-02-03 17:30:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'755 x AgentTesla, 19'664 x Formbook, 12'252 x SnakeKeylogger)
ssdeep 24576:RddNizyYim+BpbFmbjra4oZqHyKZG0EnEDsi4VfPuw61ZD0QK5ZNx6I1HAEfYx:rSZgxmPra4ocHrGqcVfGwc10f5ZN5hAX
Threatray 334 similar samples on MalwareBazaar
TLSH T1AA6523996045CD13CAEB133016B2E7715379ADADAA13D3218FE9EEE73A013B07D18752
TrID 33.1% (.EXE) Win64 Executable (generic) (10522/11/4)
20.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
6.4% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter Neiki
Tags:exe PhantomStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d7bbb9f1-651c-427a-acaa-c97797f1f336/
Malware family:
n/a
ID:
1
File name:
f1557405ac36aa0506b9b7f0df7a680e.exe
Verdict:
Malicious activity
Analysis date:
2026-02-03 16:32:58 UTC
Tags:
phantom stealer crypto-regex evasion auto-startup susp-lnk
Link:
https://app.any.run/tasks/a9cf644f-3cb1-407a-b534-9bd827e6ace6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51526/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6982233987f81e55ffef05a4
Tags:
autorun virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Connection attempt
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Forced shutdown of a system process
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt obfuscated packed reconnaissance
Link:
https://www.filescan.io/uploads/69822475981ff1d38a46c0de/reports/677ffb1c-a7d0-40f9-bdb4-17589c5c2bbf/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-03T06:27:00Z UTC
Last seen:
2026-02-03T14:21:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.PowerShell.gen VHO:Backdoor.Win32.Androm.gen
Link:
https://opentip.kaspersky.com/eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5b4abafa-e25d-44da-9041-415fa6aa1c30
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f/
Verdict:
Malicious
Threat:
Family.PHANTOM
Link:
https://tip.neiki.dev/file/eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f
Threat name:
ByteCode-MSIL.Trojan.Xworm
Create hunting rule
Status:
Malicious
First seen:
2026-02-03 13:14:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5m46s7c4cbwtjvnmjdwnmklbjxz7pgh7snstloukdczfgjyslehq._file
Verdict:
malicious
Label(s):
phantomstealer
Create hunting rule
Similar samples:
1e0bbcaa4d9b3f4c144e10dad6fb9ecbde607e3c48c2d3194195f56852ef8ffb
PhantomStealer
652a96c9a54fba5d57371552348acbcd596293f65195b45b782eed0727fdf727
PhantomStealer
80556f89dc73c0363733a728326aa27fab12eba80b9afe18fb7a5fb3d1c5e5f5
PhantomStealer
815b1ccf52d1f815f76b46b5a23f203dc80debafb39e1b6c95d9d19863a69828
PhantomStealer
865bedd407bf055a750c50a398e50cfcbbb7a870a19e5931ac29e81030cc5b17
PhantomStealer
8b1ba565bae00818bc3eb21bc9632a2fbbd6a35fbe77b3034d99668776342584
PhantomStealer
9cbffe3435e4218fbfebedbbc72a2e587098bdd9eb4a4b3014a38d1d9869817b
PhantomStealer
b7534f156389d7a9fc56b628ca677bea08a0e6443c9b238f400120ec7c855699
PhantomStealer
error
PhantomStealer
fc3d9f89cc5a6b2824022593ed3ab4d94a72f71ef5f34953acc952141ad110f0
PhantomStealer
+ 324 additional samples on MalwareBazaar
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection discovery persistence stealer
Link:
https://tria.ge/reports/260203-t5h1fshz6b/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Drops startup file
Detects PhantomStealer payload
PhantomStealer
Phantom_stealer family
Unpacked files
SH256 hash:
eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f
MD5 hash:
f1557405ac36aa0506b9b7f0df7a680e
SHA1 hash:
9a44ffb33b4bb3c14d56328c144e098f6cc77b38
Link:
https://www.unpac.me/results/8e3721e8-7abf-4293-8157-5151919fcf5b/
SH256 hash:
7574aad8b457abdd1f45b8181ba85496d47718e3e0e246a303061d9c86e3c57c
MD5 hash:
6ef9af68e2076a646975f7f9dd6475f6
SHA1 hash:
0e5c86acb143b0f27bfb385f28d50b26c6c5bf80
Link:
https://www.unpac.me/results/8e3721e8-7abf-4293-8157-5151919fcf5b/
SH256 hash:
264f6c56e64e7f056e9a405e9b89a8d62a33c219df90f420b6a8c4aaa0ddf3ea
MD5 hash:
92fab9cbbd05b75fed4cc58012354e61
SHA1 hash:
411c2744672849a14b3761114eb7a4e32540215f
Detections:
phantom_stealer
Create hunting rule
cn_utf8_windows_terminal
Create hunting rule
INDICATOR_EXE_Packed_Fody
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames
Create hunting rule
Link:
https://www.unpac.me/results/8e3721e8-7abf-4293-8157-5151919fcf5b/
Parent samples :
b6eb415d7b1be65850ede04ebe14006c319b11be80702c1d10ffd58a915a4f0f
4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
b5c87ae305492fcb39c332e34bb86cf96e0906d89eb7bedf552b740a877ca97d
0cbb7f1b15b8cd50b8269b954738cbad9099994d60df5309ac5326c3886c3d10
eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f
SH256 hash:
cff92df03ab5bb5107a1d47d78c3a5a5437ce21987e7f2be102468334cf05bfb
MD5 hash:
ba3e8fbc0bdafab16a599c7520a4925c
SHA1 hash:
95fdf283962743a60e1e0ef54b650fe62e32c3ec
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/8e3721e8-7abf-4293-8157-5151919fcf5b/
Malware family:
PhantomStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/eb39e97c5c10/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.threat.rip/file/eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f
Cape
Cape
https://www.capesandbox.com/analysis/51526/

Comments