Date: 07/29/2026
Severity: Medium
Summary
Phantom Stealer is a .NET-based credential-harvesting malware designed to stealthily steal browser credentials, saved passwords, session cookies, cryptocurrency wallet data, clipboard contents, and system information while maintaining persistence and evading detection. Commonly distributed through phishing emails, cracked software, Discord, Telegram, and malicious links, its modular design and stealth capabilities have made it a growing threat adopted by both novice and experienced threat actors.
Indicators of Compromise (IOC) List
Hash | b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32
382233c398cbc35dcee845ee17046815f37588a382a8106bfb9b0252ea803961
790945e17a51691483455a11af2efcbe15f2b473b65b151f50287623d1468516
01f1e5369aa0332abb681df7c37818e197ec0a5b5d7b81836b3369a2b1780950
10cfcad907275497dab92af0d687674cec3a0333f80dd16d8d22254794bb2d60
2d5003d9318ae85eb22de99d19705a3cd7bf8e5c3349df979dfb3bdfa080908e
528a46842744366b57edfc6fe2810ca7df43900db75126cd1c78f32957143364
e3ceeb24bdca8842d426e87fa61cf185d68fd7783e1a2b97d4106832ca266724
f82a4d30132b5a57cbfd81c7ab0a53d0cf0dda402c2731732a0097aceb4b0b76
b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32
be119a21bedc3a79bf4dea8bcf5adf18304997a01ea23e276b9c31be37b789ab
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | sha256hash IN ("be119a21bedc3a79bf4dea8bcf5adf18304997a01ea23e276b9c31be37b789ab","2d5003d9318ae85eb22de99d19705a3cd7bf8e5c3349df979dfb3bdfa080908e","b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32","528a46842744366b57edfc6fe2810ca7df43900db75126cd1c78f32957143364","f82a4d30132b5a57cbfd81c7ab0a53d0cf0dda402c2731732a0097aceb4b0b76","382233c398cbc35dcee845ee17046815f37588a382a8106bfb9b0252ea803961","01f1e5369aa0332abb681df7c37818e197ec0a5b5d7b81836b3369a2b1780950","790945e17a51691483455a11af2efcbe15f2b473b65b151f50287623d1468516","e3ceeb24bdca8842d426e87fa61cf185d68fd7783e1a2b97d4106832ca266724","10cfcad907275497dab92af0d687674cec3a0333f80dd16d8d22254794bb2d60")
|
Reference:
https://www.splunk.com/en_us/blog/security/phantom-stealer-shellcode-steganography-credential-theft.html