PhantomVAIMalware
- Caminho
- katz stealer loader
- vmdetectloader
PhantomVAI Loader is a malicious multi-stage infection chain used to distribute the Katz Stealer information-stealing malware or other malicious payloads.From MISP Galaxy
Last reported 10 months ago, by Zscaler ThreatLabz1 report
ATT&CK techniques
6 of 15 · each with the sentence it comes from- T1027Obfuscated Files or Information
“…nbsp;T1562.001Impair Defenses: Disable or Modify ToolsDCRAT ships with an AMSI bypass technique for both 32 and 64-bit operating systems.T1027.003Obfuscated Files or Information: SteganographyCaminho is hidden in encoded form within a PNG image.T1027.010Obfuscated Files or Inform…”
- T1047Windows Management Instrumentation
“Specifically, it leverages Windows Management Instrumentation (WMI) to obtain a Win32_Process instance.”
- T1053Scheduled Task/Job
“…tart Execution: Registry Run Keys / Startup FolderDCRAT is capable of setting persistence via RunKey if executed by an unprivileged user.T1053.005Scheduled Task/Job: Scheduled TaskDCRAT is capable of setting persistence via scheduled tasks.T1140Deobfuscate/Decode Files or Informa…”
- T1053.005Scheduled Task
“…a RunKey if executed by an unprivileged user.T1053.005Scheduled Task/Job: Scheduled TaskDCRAT is capable of setting persistence via scheduled tasks.T1140Deobfuscate/Decode Files or InformationMultiple stages in the attack chain are composed of Base64-encoded payloads. T1562.…”
- T1055Process Injection
“… obfuscation.T1027.013Obfuscated Files or Information: Encrypted/Encoded FileCaminho was stored as a text file encoded in reverse Base64.T1055.012Process Injection: Process HollowingCaminho executes a further payload (DCRAT) by hollowing a MsBuild.exe process.T1497.001Virtualizat…”
- T1055.012Process Hollowing
“The decoded payload is then executed using a technique known as process hollowing, where a legitimate Windows utility, MSBuild.exe, is launched and hollowed out to host the malicious code.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
BlindEagle Targets Colombian Government Agency with Caminho and DCRAT“BlindEagle Targets Colombian Government Agency with Caminho and DCRAT”
Indicators in its reports
named in the reports above- detection[.]inin 1 report
- ydns[.]euin 1 report
- family[.]inin 1 report
- hxxps://archive[.]org/download/optimized_msi_20250821/optimized_MSI.pngin 1 report
- hxxps://cdn.discordapp[.]com/attachments/1402685029678579857/1410251798123511808/AGT27.txt?ex=68b056d5&is=68af0555&hm=3ef2cf8f65a9a6f4955ecd0292af0cd68e65864907d07543c416ab28a2acfa6d&Thein 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.