35bc2fec0463c574c670c89b697ccdf432717040ecf852967a88ec7da51884de

General

Target
phantom-loader_2026.zip
Size 127.0MB
Sample260731-hqrhhawgpc
SHA256 35bc2fec0463c574c670c89b697ccdf432717040ecf852967a88ec7da51884de
MD5 4e0fbd4feb0f875700c245bc70549e5f
SHA1 d45b925dbcda4fd57b03804f7c403b3b0e35ace1
SHA512 186a1eb284f0f6564dbbb833eda15db11aaa98255ceeca55ed2e9aae18e68cd4008c893ada4cfd1605c3667bb51a677870410ea3bbc9408791b48519853d22d7
SSDEEP 3145728:Ee2uA/yZZCaZTij9hCeLnXEEEpx1DbCtM8C4B7ouigE7:Ees/yfbhSX3s1DGcFH7
TLSH
T16558331F704F0A19645AAF7B49C6CBE1A615BF005A606053722EC9C8DC9DB93BC0EDE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  phantom-loader_2026.zip
- Size 127.0MB
- SHA256 35bc2fec0463c574c670c89b697ccdf432717040ecf852967a88ec7da51884de
- MD5 4e0fbd4feb0f875700c245bc70549e5f
- SHA1 d45b925dbcda4fd57b03804f7c403b3b0e35ace1
- SHA512 186a1eb284f0f6564dbbb833eda15db11aaa98255ceeca55ed2e9aae18e68cd4008c893ada4cfd1605c3667bb51a677870410ea3bbc9408791b48519853d22d7
- SSDEEP 3145728:Ee2uA/yZZCaZTij9hCeLnXEEEpx1DbCtM8C4B7ouigE7:Ees/yfbhSX3s1DGcFH7
- TLSH
  T16558331F704F0A19645AAF7B49C6CBE1A615BF005A606053722EC9C8DC9DB93BC0EDE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  phantom-loader/PhantomV1.3.msi
- Size 19.4MB
- SHA256 947937dbc4cbce5159147ae5691d49a951ac44540cba2ba38f03921c49c506fe
- MD5 fccd7c6a00fec96d55a2f16fda663419
- SHA1 ba665a128f0ad04c79febf00e1ee284abe856346
- SHA512 22a46c6e06e9492596a14dd278f41aac913681432b2cdd8fef9e32c6f34154ae8020b5031863ec830de17467d60aba53da42846f0d0d202ba53a1382150f35dd
- SSDEEP 393216:w7cXB6KTLES3glvuv87upq4GCAKUdeCu3et11G0tJifiY2:w03TLEp206hA7dxIeUqY2
- TLSH
  T1091733A66C266E83CA5166BB23431742AF310DB33B1247112D79F92E1CBD1F94B5C39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4