phantom_stealer | 2026-07-21_ac06f11fbf4839ad7d21591f92c61a8b_cobalt-strike_elex_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_ac06f11fbf4839ad7d21591f92c61a8b_cobalt-strike_elex_glassworm_icedid_njrat
Size 746KB
Sample260721-vb39zacf92
SHA256 14967b7eaa3bc959adf0f0345d88561aca5cff9519e72b698facf5c569bfc48d
MD5 ac06f11fbf4839ad7d21591f92c61a8b
SHA1 cf01c02af342326cb98dc3d9b95289b8d001649f
SHA512 0ad4d6f809287f90af7f602550d672e6890bf6721f87ff914239757dce208caa08163082457c94cbb4174095c586d93898016a7bfa4aab65b41dae90a46566c0
SSDEEP 12288:r9C92gRSkfzLPMpay3OJj6wBxb8ic+Kt0+:r9CQgRxnMay3OJjvxb20+
TLSH
T1ACF49D68A3F50499F1FF8B7494B68421DE31B84BA938CB5F168452AE0D73742ED60B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer phantom_stealer

Malware Config

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_ac06f11fbf4839ad7d21591f92c61a8b_cobalt-strike_elex_glassworm_icedid_njrat

File Explorer

2026-07-21_ac06f11fbf4839ad7d21591f92c61a8b_cobalt-strike_elex_glassworm_icedid_njrat

.exe 746KB

2026-07-21_ac06f11fbf4839ad7d21591f92c61a8b_cobalt-strike_elex_glassworm_icedid_njrat

SHA256 14967b7eaa3bc959adf0f0345d88561aca5cff9519e72b698facf5c569bfc48d
MD5 ac06f11fbf4839ad7d21591f92c61a8b
SHA1 cf01c02af342326cb98dc3d9b95289b8d001649f
SHA512 0ad4d6f809287f90af7f602550d672e6890bf6721f87ff914239757dce208caa08163082457c94cbb4174095c586d93898016a7bfa4aab65b41dae90a46566c0
SSDEEP 12288:r9C92gRSkfzLPMpay3OJj6wBxb8ic+Kt0+:r9CQgRxnMay3OJjvxb20+
TLSH
T1ACF49D68A3F50499F1FF8B7494B68421DE31B84BA938CB5F168452AE0D73742ED60B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing possible sandbox analysis VM names
Detects executables containing possible sandbox analysis VM usernames
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

771274

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths