🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff
SHA3-384 hash: 43d5f5163a82cf9cd2e92b4ac1a0f203ccc152c60ce87bf20706b15671fe2e6ca94de23e9d328b57eadd4cead3ed7fe7
SHA1 hash: f2aeb19a3ad7017960ee604d620b32ea2eb354dd
MD5 hash: a6c9ace2fe50cc36083ec78e2665d75f
humanhash: early-alaska-king-beryllium
File name:f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'560'576 bytes
First seen:2026-05-08 12:51:36 UTC
Last seen:2026-06-08 08:57:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'234 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 24576:KlPtXK1SsLd91IiQnRWeahsrtuk2uEygZ1u2PVbYCLdqW90TcKOrSqTCBzuOm2/C:kiVx/MRWeaEsk2N8aVbYCRqW9jtrSI4r
TLSH T109752215237ACC02D1B6077149E6C07413B42F88E862D18B5FDA7FDBB636BD98A85783
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe PhantomStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
79
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/3357ac87-70f0-4f61-8ca6-01360635ad53/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-05-08 17:12:08 UTC
Tags:
auto-startup susp-lnk stealer phantom evasion
Link:
https://app.any.run/tasks/c2066a13-c9c2-4999-a339-1ff7628568c9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/65177/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3518.7003.31901.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Forced shutdown of a system process
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-09T23:16:00Z UTC
Last seen:
2026-05-08T07:58:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9346f4a0-6732-4ca4-9c0c-85cffda2ebbe
Result
Threat name:
KeyLogger, Phantom stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1896443
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected malicious Powershell script
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Browser instances using unsafe startup parameters
Bypasses PowerShell execution policy
Creates a thread in another existing process (thread injection)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Windows shortcut file (LNK) contains suspicious command line arguments
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Keylogger Generic
Yara detected Phantom stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1896443 Sample: PO-06517-8951-104746.exe Startdate: 10/04/2026 Architecture: WINDOWS Score: 100 81 mail.flexi-synergy.com 2->81 83 flexi-synergy.com 2->83 85 89 other IPs or domains 2->85 95 Found malware configuration 2->95 97 Antivirus / Scanner detection for submitted sample 2->97 99 Multi AV Scanner detection for submitted file 2->99 101 15 other signatures 2->101 10 PO-06517-8951-104746.exe 7 2->10         started        14 powershell.exe 2->14         started        16 firefox.exe 2->16         started        18 4 other processes 2->18 signatures3 process4 file5 75 C:\Users\user\AppData\Roaming\fzfqOzKP.exe, PE32 10->75 dropped 77 C:\Users\...\fzfqOzKP.exe:Zone.Identifier, ASCII 10->77 dropped 79 C:\Users\user\AppData\...\4d0jswfc2xh.ps1, ASCII 10->79 dropped 123 Found many strings related to Crypto-Wallets (likely being stolen) 10->123 125 Writes to foreign memory regions 10->125 127 Allocates memory in foreign processes 10->127 129 2 other signatures 10->129 20 RegSvcs.exe 25 16 10->20         started        24 powershell.exe 23 10->24         started        26 fzfqOzKP.exe 14->26         started        28 conhost.exe 14->28         started        30 firefox.exe 16->30         started        32 firefox.exe 18->32         started        signatures6 process7 dnsIp8 93 icanhazip.com 104.16.184.241 CLOUDFLARENETUS United States 20->93 105 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->105 107 Tries to steal Mail credentials (via file / registry access) 20->107 109 Tries to harvest and steal browser information (history, passwords, etc) 20->109 121 5 other signatures 20->121 34 firefox.exe 20->34         started        36 msedge.exe 20->36         started        39 msedge.exe 20->39         started        49 10 other processes 20->49 111 Loading BitLocker PowerShell Module 24->111 41 conhost.exe 24->41         started        43 WmiPrvSE.exe 24->43         started        113 Multi AV Scanner detection for dropped file 26->113 115 Writes to foreign memory regions 26->115 117 Allocates memory in foreign processes 26->117 119 Sample uses process hollowing technique 26->119 45 RegSvcs.exe 26->45         started        47 RegSvcs.exe 26->47         started        signatures9 process10 signatures11 51 firefox.exe 34->51         started        103 Installs a global keyboard hook 36->103 55 msedge.exe 36->55         started        57 msedge.exe 39->57         started        process12 dnsIp13 87 209.73.190.11 YAHOO-YSM-SC8US United States 51->87 89 209.73.190.12 YAHOO-YSM-SC8US United States 51->89 91 97 other IPs or domains 51->91 67 C:\Users\user\AppData\...\cookies.sqlite, SQLite 51->67 dropped 69 C:\Users\user\AppData\...\widevinecdm.dll.tmp, PE32+ 51->69 dropped 71 C:\Users\user\...\widevinecdm.dll (copy), PE32+ 51->71 dropped 73 2 other files (none is malicious) 51->73 dropped 59 firefox.exe 51->59         started        61 firefox.exe 51->61         started        63 firefox.exe 51->63         started        65 8 other processes 51->65 file14 process15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff/
Threat name:
Win32.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2026-04-10 11:26:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6elo3fjfialnuwinld3lhp6ihuczek46yk5tseejt5ebrwcegd7q._file
Verdict:
malicious
Label(s):
phantomstealer
Create hunting rule
Similar samples:
error
PhantomStealer
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection discovery execution persistence stealer
Link:
https://tria.ge/reports/260508-p5g1yacz5n/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Command and Scripting Interpreter: PowerShell
Detects PhantomStealer written in C#
Family: PhantomStealer
Unpacked files
SH256 hash:
f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff
MD5 hash:
a6c9ace2fe50cc36083ec78e2665d75f
SHA1 hash:
f2aeb19a3ad7017960ee604d620b32ea2eb354dd
Link:
https://www.unpac.me/results/a7c7f9e6-fccd-4533-a7b5-9f09213eb69e/
SH256 hash:
078d6a3189bf55a3cc9400e7c093bcaf30d71fa41e8a2f2e189f0238c158eb4e
MD5 hash:
5f712e96f40d84c58850e7ba8b2c91cf
SHA1 hash:
55814927550f4611587b368f4c6c42cf5546baff
Link:
https://www.unpac.me/results/a7c7f9e6-fccd-4533-a7b5-9f09213eb69e/
SH256 hash:
79a8e14b9258604a58ff73a7c5531fb2ce157a166a77c2ed69f678620ab6611c
MD5 hash:
4659006787647a5363fcc34811a7b9a4
SHA1 hash:
d30f01502e1824156c7eb31191bfb31b342f0e42
Detections:
phantom_stealer
Create hunting rule
Link:
https://www.unpac.me/results/a7c7f9e6-fccd-4533-a7b5-9f09213eb69e/
Parent samples :
cbb7c0efe21f2608e505c657bd65e1921ab6ec7d05ba8531387b28d3857a719e
59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4
7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa
a073c1ccefa9613ac2cff88a9a7455f15b9b834c2bb5f93ee523e06f1c895847
f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff
22f734f721052d5fdb9bc8da8cae323d25d5e8bb001b4481fe41ca66cab2a05e
SH256 hash:
265710a4053dc7c993ca47e266c6b9c6808530186385a0e192fe747e0e903bfc
MD5 hash:
4ff8bbf69b087c8173d1548b6164ca02
SHA1 hash:
d7ba0745511bfc645fd1f13c956fa6aff5449e40
Link:
https://www.unpac.me/results/a7c7f9e6-fccd-4533-a7b5-9f09213eb69e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f116ed95254016da590d58f6b3bfc83d05922b9ec2bb3910899f4818d84430ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/65177/

Comments