General
- Target 2026-07-30_57633f38b3932c00ff7ad6e21dcda71a_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
- Size 746KB
- Sample260730-gbttms1bpg
- SHA256 492a93539066bbb570ec921614b09f21c4a3c509c0d35fb0f501b3ed4d05b24a
- MD5 57633f38b3932c00ff7ad6e21dcda71a
- SHA1 183d27a26712a306a12af62fb5b4529f064f397f
- SHA512 6c1357d6e7755c0d1b0bb8106d6714dd83caf5fb8895420495c42fccae1d487a48b31c4834cdd7558a79a6e1682b0cb3fc7880c42ec3bafd72fc0110ba75b482
- SSDEEP 12288:/9C7vBAOwGMpgy3OzQdyBxjbCFroh3l+C6E0+:/9CjTMgy3OzQdyXbCFQl+CN0+
- TLSH T16CF47C24B3F405A4F1FF9B75D4B18422CA71B84A9A34CB8F159882AE0E73791DD74B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-30_57633f38b3932c00ff7ad6e21dcda71a_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-30_57633f38b3932c00ff7ad6e21dcda71a_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
162.254.34.31
-
Port
587
-
Username
-
Password
AteCfDOyqzTI
-
Email to
-
62R03NMONPDCRNNQJX2B
-
1FN3a3b66XakLPbFykvawsCTtKPHtBHNFp
-
0x7875027ea7D2c04535A6A78A83F18222Bc2Ce012
-
TQUkvKgoq5tZGXwAhkgLwNzurj8dnonx5J
-
clipboard
true
-
clipper
true
-
cookies
true
-
credit_cards
true
-
keylogger
true
-
passwords
true
-
screenshot
true
-
smtp_enabled
true
Extracted
-
Protocol
smtp
-
Host
162.254.34.31
-
Port
587
-
Username
-
Password
AteCfDOyqzTI
Targets
-
- Target 2026-07-30_57633f38b3932c00ff7ad6e21dcda71a_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
- Size 746KB
- SHA256 492a93539066bbb570ec921614b09f21c4a3c509c0d35fb0f501b3ed4d05b24a
- MD5 57633f38b3932c00ff7ad6e21dcda71a
- SHA1 183d27a26712a306a12af62fb5b4529f064f397f
- SHA512 6c1357d6e7755c0d1b0bb8106d6714dd83caf5fb8895420495c42fccae1d487a48b31c4834cdd7558a79a6e1682b0cb3fc7880c42ec3bafd72fc0110ba75b482
- SSDEEP 12288:/9C7vBAOwGMpgy3OzQdyBxjbCFroh3l+C6E0+:/9CjTMgy3OzQdyXbCFQl+CN0+
- TLSH T16CF47C24B3F405A4F1FF9B75D4B18422CA71B84A9A34CB8F159882AE0E73791DD74B63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing possible sandbox analysis VM names
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1