🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
SHA3-384 hash: 2b36b518bedf9061445e978e7de4c2c56da70f5b7aae86b2a982f1dc9e0432e970bf7d6a6c59bc67664026b94b36930f
SHA1 hash: 9cee61773e655e93cd4d0082f5007fa6b2e8f63e
MD5 hash: 59f94c914a02913c034de99447c86b52
humanhash: snake-pluto-carolina-alpha
File name:fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'630'208 bytes
First seen:2026-09-10 11:07:28 UTC
Last seen:2026-10-19 07:17:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'298 x AgentTesla, 20'717 x Formbook, 12'402 x SnakeKeylogger)
ssdeep 49152:6b/2oSV+dICgRRHoCS3D9ipGaR5CiuUtOtZzMG:6buoKCgPBg5ipGaXC7Zz
TLSH T1E575125822A5EE02D2E26BF41C20F3B857B91E497922E3078EF5ADDFB5396443D452C3
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe PhantomStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ad66b6eb-9d84-429f-9806-af65f15f6b39/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-10 13:21:59 UTC
Tags:
auto-reg netreactor qrcode phantom stealer ip-check evasion smtp
Link:
https://app.any.run/tasks/07112492-9d1a-42da-a362-7ba84a9809a7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/84914/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aca1a5b07fd5593f613985d
Tags:
infosteal redline emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file in the %temp% subdirectories
DNS request
Connection attempt
Sending an HTTP GET request
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6aa28faec36062101bf4cc2d/reports/1472774e-d5da-488c-9606-abb6dec975c5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-25T06:51:00Z UTC
Last seen:
2026-09-11T18:29:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/97233494-38f4-4ddc-8b92-9bb43039d20d
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.40 Win 32 Exe x86
Link:
https://app.malva.re/file/59f94c914a02913c034de99447c86b52
Detection:
phantomstealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9/
Threat name:
ByteCode-MSIL.Trojan.XWorm
Create hunting rule
Status:
Malicious
First seen:
2026-08-25 09:45:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7kfxi2uagykanec4o3vj3la4zq4scbexax5kn44wygcn5tbnkg4q._file
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260910-m78wbssbqa/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Detects PhantomStealer written in C#
Family: PhantomStealer
Unpacked files
SH256 hash:
fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
MD5 hash:
59f94c914a02913c034de99447c86b52
SHA1 hash:
9cee61773e655e93cd4d0082f5007fa6b2e8f63e
Link:
https://www.unpac.me/results/6e2baa7d-af27-41be-aab0-97e1bba324ec/
SH256 hash:
bfac96b1dd35147ffa17e4726b3915e065868aa0214199aa6f23bbf38d588136
MD5 hash:
78e7e16df4d86bde7a8bb077543f1739
SHA1 hash:
54f3a609ea7d6e46ad6c88e5111619bb19ad1fc9
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6e2baa7d-af27-41be-aab0-97e1bba324ec/
SH256 hash:
df55e6e5aaf16052a3773eed8e93190ed25f47d169334672f115d927b6c32348
MD5 hash:
f9b47bd2c2b197ff0371a147360e1ba3
SHA1 hash:
a4186c331727f395afd23feddb0c01304d69ae60
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6e2baa7d-af27-41be-aab0-97e1bba324ec/
Parent samples :
7c8f7db949018432012992815692f2595c6d9c290cbc1dc14cc17615d1f8d43d
8da2763b7ee25e8ecd2b448549f1381c15bfb934653472a09125869b6513cfb8
fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
SH256 hash:
d8f7cb5cdb5642a498d6d6f0d52cc8debf3819c0c59f7c9e5144317f9bef22ad
MD5 hash:
49e51ab6698d6a37ed28fe0516db867d
SHA1 hash:
d915683b9c40caa4ac020721301d2a354ac64014
Detections:
phantom_stealer
Create hunting rule
cn_utf8_windows_terminal
Create hunting rule
INDICATOR_EXE_Packed_Fody
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon
Create hunting rule
Link:
https://www.unpac.me/results/6e2baa7d-af27-41be-aab0-97e1bba324ec/
Parent samples :
9fc4da23cd58e6a0c093804a0b64886e8f5a41e2003a79dde49dc3c762da5bde
5bddfd79c9fce9b9a38f93cb83eecc1571de4bfc78e0dd276945e4e40417a5f1
41652e0a1f50751190f05a41462c466593813c6705b6fd60343df28ed0650d27
acf4f15c15cc5f0df253d8c6fe8213b0c2c07d8add245a264a17051c1dad26b0
c90529f66cc40fb2235eb0f1a02b98f8b96b114f6024c0f08f8f06055cafa4f7
70501144a459b9fdbc8b6e549fbc08db479b7d7aab4e02a352b3f11ba1ec686a
e4e03303d684448e737cb25d37413d13d5895be417d2d748b881c96adea8964d
7c8f7db949018432012992815692f2595c6d9c290cbc1dc14cc17615d1f8d43d
8da2763b7ee25e8ecd2b448549f1381c15bfb934653472a09125869b6513cfb8
fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
Malware family:
PhantomStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fa8b746a8036/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/84914/

Comments