🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhantomStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef
SHA3-384 hash: e4ee2e40644127594840b46b4088912f342e61bf731fe0c7ae90c12986a49ca880abdb0b0776c015e9b3acd7ed527ea0
SHA1 hash: ce147e4941248647e59168df4e92e0331416aa0d
MD5 hash: 7ea1ac9405b7ffcb6c087e3b65d1462a
humanhash: oxygen-beryllium-ten-whiskey
File name:FİYAT TEKLİFİ HK. FORMU 6003045029 Teknik Şartnamesi PO 3362 2026 0320.bat
Download: download sample
Signature PhantomStealer
Create hunting rule
File size:1'610'752 bytes
First seen:2026-09-10 06:01:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'616 x Formbook, 12'394 x SnakeKeylogger)
ssdeep 24576:I7YdkEqFculT27x/cVZr8QaYolcLrp+kx+EBMu8cyHxf+IFGBNz33ZDorwSbqj0e:F2paC27x/cTbafwmuWxj8NTJsC
TLSH T1607522682612DA07D8015B784A71F6B92BBE1EDD6910D3239FE9BDFB7535F068C04283
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:bat exe geo PhantomStealer TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/119f0e8c-fcd6-49a7-9c56-aef48555feaa/
Malware family:
guloader
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-10 06:02:58 UTC
Tags:
auto-reg guloader loader phantom stealer ip-check evasion smtp
Link:
https://app.any.run/tasks/aaa4b2d1-c016-4f57-8cfa-e87617148892

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/84724/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac93a05ff69886faa0ad7a7
Tags:
keylog spam sage word
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-08T06:57:00Z UTC
Last seen:
2026-09-12T04:13:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/28bd7028-fc16-48e9-8f84-bca2b94d154b
Result
Threat name:
KeyLogger, Phantom stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1971158
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Browser instances using unsafe startup parameters
Bypasses PowerShell execution policy
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Monitors registry run keys for changes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Executable File Creation
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Keylogger Generic
Yara detected Phantom stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1971158 Sample: F#U0130YAT TEKL#U0130F#U013... Startdate: 10/09/2026 Architecture: WINDOWS Score: 100 76 mail.prensiptur.com 2->76 78 telemetry-incoming.r53-2.services.mozilla.com 2->78 80 13 other IPs or domains 2->80 102 Suricata IDS alerts for network traffic 2->102 104 Found malware configuration 2->104 106 Multi AV Scanner detection for dropped file 2->106 108 23 other signatures 2->108 9 F#U0130YAT TEKL#U0130F#U0130 HK. FORMU 6003045029 Teknik #U015eartnamesi PO 3362 2026 0320.bat.exe 1 6 2->9         started        13 firefox.exe 2->13         started        15 msedge.exe 2->15         started        18 5 other processes 2->18 signatures3 process4 dnsIp5 66 C:\Users\user\AppData\Roaming\tdq.exe, PE32 9->66 dropped 68 F#U0130YAT TEKL#U0...26 0320.bat.exe.log, ASCII 9->68 dropped 126 Found many strings related to Crypto-Wallets (likely being stolen) 9->126 128 Creates autostart registry keys with suspicious values (likely registry only malware) 9->128 130 Creates multiple autostart registry keys 9->130 134 2 other signatures 9->134 20 F#U0130YAT TEKL#U0130F#U0130 HK. FORMU 6003045029 Teknik #U015eartnamesi PO 3362 2026 0320.bat.exe 26 14 9->20         started        25 powershell.exe 23 9->25         started        27 firefox.exe 13->27         started        96 192.168.2.4, 138, 443, 49400 unknown unknown 15->96 98 239.255.255.250 unknown ZZ 15->98 70 C:\...\the-real-index~RF29be8.TMP (copy), COM 15->70 dropped 72 C:\Users\user\...\the-real-index (copy), COM 15->72 dropped 74 C:\Users\user\AppData\Local\...\temp-index, COM 15->74 dropped 29 msedge.exe 15->29         started        31 setup.exe 15->31         started        37 5 other processes 15->37 100 127.0.0.1 unknown unknown 18->100 132 Injects a PE file into a foreign processes 18->132 33 conhost.exe 18->33         started        35 conhost.exe 18->35         started        39 2 other processes 18->39 file6 signatures7 process8 dnsIp9 82 mail.prensiptur.com 37.247.114.169, 49758, 587 BKVG-ASDE Turkey 20->82 84 icanhazip.com 104.16.185.241, 49752, 80 CLOUDFLARENET-CloudflareIncUS Canada 20->84 58 F#U0130YAT TEKL#U0...2 2026 0320.bat.exe, PE32 20->58 dropped 60 F#U0130YAT TEKL#U0...exe:Zone.Identifier, ASCII 20->60 dropped 110 Tries to steal Mail credentials (via file / registry access) 20->110 112 Creates autostart registry keys with suspicious names 20->112 114 Creates multiple autostart registry keys 20->114 120 6 other signatures 20->120 41 msedge.exe 20->41         started        44 chrome.exe 20->44         started        46 chrome.exe 20->46 injected 54 2 other processes 20->54 116 Loading BitLocker PowerShell Module 25->116 48 conhost.exe 25->48         started        86 content-signature-2.cdn.mozilla.net 34.149.226.178, 443, 49763, 49764 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 27->86 92 4 other IPs or domains 27->92 62 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 27->62 dropped 64 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 27->64 dropped 118 Installs a global keyboard hook 27->118 50 firefox.exe 27->50         started        88 mr-b01.tm-azurefd.net 150.171.110.193, 443, 49734 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 29->88 90 ln-0007.ln-msedge.net 150.171.22.17, 443, 49717, 49720 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 29->90 94 32 other IPs or domains 29->94 52 setup.exe 31->52         started        file10 signatures11 process12 signatures13 122 Monitors registry run keys for changes 41->122 124 Installs a global keyboard hook 41->124 56 msedge.exe 41->56         started        process14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.39 Win 32 Exe x86
Link:
https://app.malva.re/file/7ea1ac9405b7ffcb6c087e3b65d1462a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-09-08 12:58:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7shqfqw3wnjsefjpgmgaxbzlw4pkgdkkordsonctdzqn5hzektxq._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/753d0dfc-341f-4840-a772-928f03cbd31c
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260910-grkwnshj5w/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Detects PhantomStealer written in C#
Family: PhantomStealer
Unpacked files
SH256 hash:
fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef
MD5 hash:
7ea1ac9405b7ffcb6c087e3b65d1462a
SHA1 hash:
ce147e4941248647e59168df4e92e0331416aa0d
Link:
https://www.unpac.me/results/6da99d9f-552e-4d64-9dbf-640514b439a3/
SH256 hash:
60bdee938635f42ec81f396de80e99f7bbbe69d6af4d60c265adaab3d1c90ced
MD5 hash:
10d9fec87e9983c03f69470c3c3ff200
SHA1 hash:
0554c8193d28e7bb05fe077a44f53138bdc21fb9
Link:
https://www.unpac.me/results/6da99d9f-552e-4d64-9dbf-640514b439a3/
SH256 hash:
4084c1c307a55d3a890a225ee0e47717ac5f2e003d2470fdb40aaa4fce543aa7
MD5 hash:
461638f3bb18b2077d5d0190df522c21
SHA1 hash:
59797dea15d393692e56902929ef0ee0c7973f42
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6da99d9f-552e-4d64-9dbf-640514b439a3/
SH256 hash:
92c540aa9e4b579bd2c6a5b17f5b0adf31d63f367017cda95a94de539e65dd18
MD5 hash:
81a5ea8e0fcb9227996038fcce592723
SHA1 hash:
c157d08be226499a717d101bfbfa0d2a1e7c0662
Detections:
phantom_stealer
Create hunting rule
cn_utf8_windows_terminal
Create hunting rule
INDICATOR_EXE_Packed_Fody
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon
Create hunting rule
Link:
https://www.unpac.me/results/6da99d9f-552e-4d64-9dbf-640514b439a3/
Parent samples :
1fe20f1ffd40e292837f4401f094e9d830874ae46f7a036ec66d5e720edf18a9
c5c29720693314c6492a45268a4852d5c6efb4698d928ac6f68c283ea7c9f785
5d23a0e4656f41bcb064307a614565b32cf6d04d6b38a910f24570907f29b436
db0864b36e22c383e8e59b8d2d4610276ab4bbd97d7b382bdb451fb7ed9a6540
420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89
d6168fea1d549e10df9f33d41a6058573f32312eb67b1cc48756dca2558479ca
7c26003b25a03f34ac2ddd11324d2501506ef7fa694cac3ec9d63717d3071783
e7096f11b4ea7f7ba0bcafc509b6642942ab3f8ff46b93bfab2170a516c28425
863e5790dc76c8ef082144e1f7ed91e92cb72960172b56af593737c738cfc8f5
c6f8729d491286d2deaa843edd031cd48e735b9c4963825d94b53a2bec084be4
985059c645fa9b5ad5b804ab23f6d023bb5a324d66677bac0b4a43ee1f5496a6
fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/84724/

Comments