Extracted

Extracted

• • Target
    2026-07-20_f06258a9a4c0fa1c7fa4df4761625354_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
  • Size 746KB
  • SHA256 1786cd3e32e535af9920fa7711a40b057dae63f81cbf639d8e21eee0cbf4f557
  • MD5 f06258a9a4c0fa1c7fa4df4761625354
  • SHA1 899cada93c2ef0fed90d2ab6b0989b2ae6ff60d1
  • SHA512 8a2ce380235b6e07884c2a6caa4fecefd2fdaad286149c5a3d7fa7ce4d3639fd2608dbb1e4f9e11802dda1fef358bf695dd38d582074a00a63fcce9e741fae56
  • SSDEEP 12288:J9CkpzwB2xdMpNy3OzQdyBxjbCFroh3l+C6E0+:J9CwjMNy3OzQdyXbCFQl+CN0+
  • TLSH
    T185F46C24B3F405A4F1FF9B75D4B18522CA71F84A9A34CB8F159882AE0E737919D34B63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryphantom_stealerspywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing possible sandbox analysis VM names

  • Detects executables containing possible sandbox analysis VM usernames

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2