Extracted

• • Target
    2026-10-15_ce2990a913780d3aa2f194c8e9152ed0_glassworm_icedid_luca-stealer_mass-logger_njrat
  • Size 1.9MB
  • SHA256 13cee49212b02538acec3887804d62cd696f29cbe37e5231809f16f384619be9
  • MD5 ce2990a913780d3aa2f194c8e9152ed0
  • SHA1 7d28512bf5c1d977e7445c3894cb6fd0dbcc659b
  • SHA512 5ffa10c01c540e3524769984ac6a2cbbda664e5aac51b9849370a30bfc2aab167ece15ba4dc6ec6d13aa775fcf8d915fe56a90005687fb8e956a1a90a46b79b7
  • SSDEEP 49152:AhbldvoJkw8oj15e4w8xhACEKzs57Xci5NLd:Ahb3voJeojPJw80Rp7XcO1
  • TLSH
    T13A95CF5623F40264F2FFA674D9B20A16CA72F80B9A71E74F06C4549E0E73B90DD25B63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryphantom_stealerpersistencespywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing possible sandbox analysis VM names

  • Detects executables containing possible sandbox analysis VM usernames

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2