General

  • Target
    2026-07-30_0d8c2d896f3a6bc8c9de054d0d9fe998_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
  • Size 746KB
  • Sample260730-gp47javsgw
  • SHA256 68df7b6f9d19fa367adc824210afb8a8272deda7fe4e79657cb12723d20298ef
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • phantom_stealer

Version
  • v4.0.0

Credentials
Mutex
  • 4D51VYR0C2DGCH0GMTBC

Wallets
  • 16iZiy7E6DiWq6C1v1yYU72nV9uy5RdKWv

  • 0xCbCf3C0517d956BE6C10Aa019256545B63b0554E

  • TQUkvKgoq5tZGXwAhkgLwNzurj8dnonx5J

Attributes
  • clipboard

    true

  • clipper

    true

  • cookies

    true

  • credit_cards

    true

  • keylogger

    true

  • passwords

    true

  • screenshot

    true

  • smtp_enabled

    true

Extracted

Credentials
  • Protocol

    smtp

  • Host

    162.254.34.31

  • Port

    587

  • Password

    fu8I18SheSvP

Targets

    • Target
      2026-07-30_0d8c2d896f3a6bc8c9de054d0d9fe998_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
    • Size 746KB
    • SHA256 68df7b6f9d19fa367adc824210afb8a8272deda7fe4e79657cb12723d20298ef
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

    • Detects executables containing possible sandbox analysis VM names

    • Detects executables containing possible sandbox analysis VM usernames

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

    • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v16

Tasks