General

  • Target
    2026-07-30_57633f38b3932c00ff7ad6e21dcda71a_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
  • Size 746KB
  • Sample260730-gbttms1bpg
  • SHA256 492a93539066bbb570ec921614b09f21c4a3c509c0d35fb0f501b3ed4d05b24a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • phantom_stealer

Version
  • v4.0.0

Credentials
Mutex
  • 62R03NMONPDCRNNQJX2B

Wallets
  • 1FN3a3b66XakLPbFykvawsCTtKPHtBHNFp

  • 0x7875027ea7D2c04535A6A78A83F18222Bc2Ce012

  • TQUkvKgoq5tZGXwAhkgLwNzurj8dnonx5J

Attributes
  • clipboard

    true

  • clipper

    true

  • cookies

    true

  • credit_cards

    true

  • keylogger

    true

  • passwords

    true

  • screenshot

    true

  • smtp_enabled

    true

Extracted

Credentials
  • Protocol

    smtp

  • Host

    162.254.34.31

  • Port

    587

  • Password

    AteCfDOyqzTI

Targets

    • Target
      2026-07-30_57633f38b3932c00ff7ad6e21dcda71a_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
    • Size 746KB
    • SHA256 492a93539066bbb570ec921614b09f21c4a3c509c0d35fb0f501b3ed4d05b24a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

    • Detects executables containing possible sandbox analysis VM names

    • Detects executables containing possible sandbox analysis VM usernames

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

    • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v16

Tasks