Extracted

Extracted

• • Target
    2026-10-15_8913fac1296bb8622d39922a68f0e0b9_glassworm_icedid_luca-stealer_mass-logger_njrat
  • Size 1.8MB
  • SHA256 9dac4c7b111ece4b78ac716d98f44526e6e2ed1ec4a418030e043c762f3218e6
  • MD5 8913fac1296bb8622d39922a68f0e0b9
  • SHA1 d727fc850a1cd9e442c536a2b9fe5b87ff80373a
  • SHA512 97b577421176a6fb810bf1bed4b05feec1423caecbcdb927fce0ec602197f31796da9c71e47514801913a05d771f6afeb608ab53c52481e62e7f1aa6b70bc9d9
  • SSDEEP 49152:e8CVtsXSMoj15e4w8xhACEKzs57Xci5NLdr:e8CVteojPJw80Rp7XcO1d
  • TLSH
    T10D95CF1A63F406A9F1FF9F79D8B14905CA72F84B9A34D74F0684449E0E33B90AD25B63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryphantom_stealerspywarestealer

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing possible sandbox analysis VM names

  • Detects executables containing possible sandbox analysis VM usernames

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2