Extracted

Extracted

• • Target
    2026-08-01_e6e48e323c5c0091d548b647acf4b85b_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat
  • Size 746KB
  • SHA256 9d6abd968c78a7ab58040ecbacbd8673dd859723e2f311769d2fda0fce0d123c
  • MD5 e6e48e323c5c0091d548b647acf4b85b
  • SHA1 c6791188a6d03b158b96611bfe34269921fd9a82
  • SHA512 5a94e255f3f5b6163f847339b168bec6b05b3f572398a418082bc532e15f42122ced6f47b17fb0b5e55e30117944d38dc8d47224c34f3336e2f266d875812340
  • SSDEEP 12288:79C7V4VL+NjrTJyHSvMpTy3OzQdyBxjbCFroh3l+C6E0+:79Cp4IjMTy3OzQdyXbCFQl+CN0+
  • TLSH
    T14FF47C64B3F405A4F1FF9B75D4B18422CA71B84B9A34CB8F159882AE0E337919D74B63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryphantom_stealerspywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing possible sandbox analysis VM names

  • Detects executables containing possible sandbox analysis VM usernames

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2