General
- Target 2026-07-30_0d8c2d896f3a6bc8c9de054d0d9fe998_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
- Size 746KB
- Sample260730-gp47javsgw
- SHA256 68df7b6f9d19fa367adc824210afb8a8272deda7fe4e79657cb12723d20298ef
- MD5 0d8c2d896f3a6bc8c9de054d0d9fe998
- SHA1 82e531868171dc4834ed68d547732b9c9586fa27
- SHA512 fa8d3cb93a9da7a1d0f2e7e8552e0f824b57d48371d268ac7b305d9a9a94e09649f4fab02ea439fc195538904b0f2eae45faa1e2408db2509ec94792838e5d09
- SSDEEP 12288:p9CTvBAyx0Mpky3OzQdyBxjbCFroh3l+C6E0+:p9CrOMky3OzQdyXbCFQl+CN0+
- TLSH T130F47C24B3F409A4F1FF9B75D4B18522CA71B84B9A34CB8F1598829E0E337919D74B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-30_0d8c2d896f3a6bc8c9de054d0d9fe998_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-30_0d8c2d896f3a6bc8c9de054d0d9fe998_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
162.254.34.31
-
Port
587
-
Username
-
Password
fu8I18SheSvP
-
Email to
-
4D51VYR0C2DGCH0GMTBC
-
16iZiy7E6DiWq6C1v1yYU72nV9uy5RdKWv
-
0xCbCf3C0517d956BE6C10Aa019256545B63b0554E
-
TQUkvKgoq5tZGXwAhkgLwNzurj8dnonx5J
-
clipboard
true
-
clipper
true
-
cookies
true
-
credit_cards
true
-
keylogger
true
-
passwords
true
-
screenshot
true
-
smtp_enabled
true
Extracted
-
Protocol
smtp
-
Host
162.254.34.31
-
Port
587
-
Username
-
Password
fu8I18SheSvP
Targets
-
- Target 2026-07-30_0d8c2d896f3a6bc8c9de054d0d9fe998_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
- Size 746KB
- SHA256 68df7b6f9d19fa367adc824210afb8a8272deda7fe4e79657cb12723d20298ef
- MD5 0d8c2d896f3a6bc8c9de054d0d9fe998
- SHA1 82e531868171dc4834ed68d547732b9c9586fa27
- SHA512 fa8d3cb93a9da7a1d0f2e7e8552e0f824b57d48371d268ac7b305d9a9a94e09649f4fab02ea439fc195538904b0f2eae45faa1e2408db2509ec94792838e5d09
- SSDEEP 12288:p9CTvBAyx0Mpky3OzQdyBxjbCFroh3l+C6E0+:p9CrOMky3OzQdyXbCFQl+CN0+
- TLSH T130F47C24B3F409A4F1FF9B75D4B18522CA71B84B9A34CB8F1598829E0E337919D74B63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing possible sandbox analysis VM names
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1