Phantom_KeyTool.zip
- SHA256 b2714f93b5085cf5bee17827165497953ee46e6667d447351456c24e80e55bd6
Overview
overview
7Static
static
3Phantom_KeyTool.zip
windows10-2004-x64
3Phantom_KeyTool.zip
windows11-ltsc_2024-x64
1Phantom_KeyTool.msi
windows10-2004-x64
7Phantom_KeyTool.msi
windows11-ltsc_2024-x64
7backup_119.dll
windows10-2004-x64
1backup_119.dll
windows11-ltsc_2024-x64
1backup_126.sdat
windows10-2004-x64
3backup_126.sdat
windows11-ltsc_2024-x64
3meta_111.sdat
windows10-2004-x64
3meta_111.sdat
windows11-ltsc_2024-x64
3module_14.dat
windows10-2004-x64
3module_14.dat
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Phantom_KeyTool.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Phantom_KeyTool.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Phantom_KeyTool.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
Phantom_KeyTool.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
Behavioral task
behavioral5
Sample
backup_119.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
backup_119.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
backup_126.sdat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
backup_126.sdat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
meta_111.sdat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
meta_111.sdat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
module_14.dat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
module_14.dat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Phantom_KeyTool.zip
- Size 21.6MB
- Sample260801-e5m7vadf74
- SHA256 b2714f93b5085cf5bee17827165497953ee46e6667d447351456c24e80e55bd6
- MD5 f128f74674f795bc4d58d65c9c193119
- SHA1 887ac001c5af020d04fdfb43bbadbb62da3a323d
- SHA512 ed64f867584f63b04473fc46632af603bdc7ba496905409b615f0ffe4e15ab0ec736663dcc89d9c76dc328a2dc28be94c7507c74d944ab99331d1a843a754fc9
- SSDEEP 393216:fgYUpqpdxjQdxfgrvGwu1ClfEtEhnF56smfnjUBUxI+H4a/ikYaIN123Ex:fXUpqziP4rvP1fUEhnFkrfn4CruN12c
- TLSH T10B3733EC202066BE9A3677F931C065FBAF817E431290EB65D3020D72255D6F9AFF8164
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Phantom_KeyTool.msi
File Explorer
-
Phantom_KeyTool.zip.zip 21.6MB
-
Phantom_KeyTool.msi.msi 19.4MB
-
backup_119.dll728KB
-
backup_126.sdat739KB
-
meta_111.sdat620KB
-
module_14.dat715KB
Phantom_KeyTool.msi
- SHA256 6e1d0af7d3e09376aaa21df8fef6db5b453573e204f059536f9ad394c5de736c
- MD5 06ebddbb40495c2f9bfb5b2324587431
- SHA1 9dca648e996e8a82eecf70bc8107cfb3c44f5a7c
- SHA512 adeeb5179e2c42c950c40705a5987b939ce8509ade490be41dd5681bd7b0422b2e19ed25dfc0d3bc8aee35a91256a8c66db5d186c45c67899c954e4b96d8733c
- SSDEEP 393216:ZXcW7pskS3glvSv87up24GCAKUdyCu3et11Gu5r69iY:Z77ptpa061A7dtIeKIY
- TLSH T18A2733A628226E83CA6566BB23431342AF310DB33B1187112D7DF92D1CBD1FA5B5D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
230e4f7e5ed01052766380b52248d1824ecfbc13a33b31eafecdd8f3e768931e
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Prehash
Signing Certificate
CN=Crash Dump Switch,O=StoneCreek North Apps,L=Lisbon,C=PT
Chains
Jul 31, 2026
CN=Crash Dump Switch,O=StoneCreek North Apps,L=Lisbon,C=PT
Subject
CN=Crash Dump Switch,O=StoneCreek North Apps,L=Lisbon,C=PT
Serial Number
39:54:07:ac:10:c9:fe:95:48:ea:56:27:88:7a:64:b8
Issuer
CN=Crash Dump Switch,O=StoneCreek North Apps,L=Lisbon,C=PT
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 31, 2026 - Jul 31, 2030
Subject
CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE
Serial Number
84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4
Issuer
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 15, 2025 - Jan 10, 2037
Subject
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Serial Number
83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f
Issuer
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 16, 2025 - Jul 16, 2041
Subject
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 9, 2020 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034
backup_119.dll
- SHA256 54e13bb51627de012340672706585a17a4da0387b6e71242047a29afff4b0f81
- MD5 7e1469e8c78c8102f7e566778fc7adff
- SHA1 424885ff67c42ab7c92427137626505b9a090883
- SHA512 24b46aa072d1b13efb4db88cfe0b18cef598213d4e56ec56e65d3d7037ce18e13a936cf9eff25940ec351ba3d379877dc62b43107342207929052ac8d2a77675
- SSDEEP 12288:iIpm+K5mWtSqv1j7smTU4bygHtAh9NF7vmqNOLe51N2diGIKra/rGibKe:f+5b4G1j75wMyKtE9NF7vmqcLe8irLbZ
- TLSH T1EFF433BD42D24334629FA7C8DC24B6A61EC44C2013F524AF4861D8B6F476F6DAC77897
- MD5 SHA1 SHA512 SSDEEP TLSH
backup_126.sdat
- SHA256 6411419e9a797270fab0aa15837e646f7332a5ae1bd9c909d43761c36c0bf7e7
- MD5 afca7476e222dc4a1cd68e6d7a84aeae
- SHA1 e25fa7db474077538c8ff6bdb1e578bedb7b15a6
- SHA512 c85c43556d9aae55517bd1cdc006e8c137bb4e49463e794e1b50c7af00716d9e4982a21bb8ce4a9407fa88a72233402e0ec3a526734f4daf60930355d2f9253f
- SSDEEP 12288:kkPK1uUJGTZcbmNRi+uwVZOVyAPJCxIR1onARugm11Fe3c8aa0xfWpIrxaXHQ:kSK2FcWi+uiZWPRol0s8IApIdaXw
- TLSH T1DFF423A4EC9898B7D720AB447FC9C69917E70DFC8592C7FD011CAC508CAA965BF26C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
meta_111.sdat
- SHA256 fcfc41c855c6cdd9cbf1ed0bf4133114532906a9ce3ba6c6a63187b5fbd0e700
- MD5 7065870aec84deaea38835d9b375b141
- SHA1 5da385f87dcf848ee8f92db0bfb48d877710bee3
- SHA512 13d717164634888c40c0b3721be71551e44f147edaec62d9b63bd3a87002de2938b3517f356a98a1e7a36e77906f177c16ee36322999d1a284d2d7979ab34d79
- SSDEEP 12288:wCEUal+21EkjYTpHL/swvtU3AV1i28NLTu+ryDrABMj0QvTybngfx5w9:wCEUa91hjYZtgAV1h8NGYfBabugfrw9
- TLSH T120D4239922E5160CCE28D9F375470759FCEDF8CCA88BDC3DD6902A8B7578448883D2D9
- MD5 SHA1 SHA512 SSDEEP TLSH
module_14.dat
- SHA256 c60a4a9b460dd6756ebf66d78f1214ec2711e032d42b330add351ffe8848f12f
- MD5 85dd8c72e6cd6e21f10d1e69fc705b32
- SHA1 34ad7b0cc70af3c9c786a179362edbf29478a63e
- SHA512 3ddd1273bb7e690f4e190038f94dbd3c738e4d6ff63977d3adfb42e68dab82b32f688a5743f601f408a7ed4abcc00df150fd850f92f2fb6a18fc16d7bb755468
- SSDEEP 12288:fTc9vYp8Rom/NEM+5nb9EHCDRvE2AXv3J2wyQleyYOXlokzFpl1SMH6ZCmFv/:oTFEM+ZhEHCDifXvIwyQle9OVnrzStEM
- TLSH T1AEF433A4DD2317304AC32E581FF867CA9EC8A633742A3FA662A16F7D916DDDC45DC120
- MD5 SHA1 SHA512 SSDEEP TLSH