SYMBOLCOMMON_NAMEaka. SYNONYMS
win.phantompull (Back to overview)

PHANTOMPULL

According to Elastic Security Labs, PHANTOMPULL is a 64-bit Windows loader used to deliver the PHANTOMPULSE RAT in a social engineering campaign that abuses Obsidian's Shell Commands community plugin. It extracts an AES-256-CBC-encrypted PE from its own resources, decrypts it with a hardcoded key, and runs it through a timer queue callback that reflectively loads it entirely in memory. This in-memory second stage creates a mutex, downloads the XOR-encrypted PHANTOMPULSE payload from its C2 over HTTPS via WinHTTP, and retries with exponential backoff, then reflectively loads it via its DllRegisterServer export. The loader resolves its APIs at runtime with djb2 hashing, decrypts its strings with a rotating XOR key, and carries unreachable dead code and a fake integrity check meant to waste analyst time.

References
2026-04-14 ⋅ Daniel Stepanic, Salim Bitam, Samir Bousseaden
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
PHANTOMPULL PHANTOMPULSE
Yara Rules
[TLP:WHITE] win_phantompull_w0 (20261012 | No description)
rule win_phantompull_w0 {
    meta:
        author = "Elastic Security"
        id = "e5dfd651-5fd3-4d88-8de7-96ed5706f553"
        fingerprint = "73d8dde2e57a9c883470c47a115ceeb194ebd39b01a1f5200b8677b25350b897"
        creation_date = "2026-04-13"
        last_modified = "2026-05-05"
        threat_name = "Windows.Trojan.PhantomPull"
        reference_sample = "70bbb38b70fd836d66e8166ec27be9aa8535b3876596fc80c45e3de4ce327980"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phantompull"
        malpedia_version = "20261012"
        malpedia_license = "Elastic License v2"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $GetTickCount = { 48 83 C4 80 FF 15 ?? ?? ?? ?? 83 F8 FE 75 }
        $djb2 = { 45 8B 0C 83 41 BA A7 C6 67 4E 49 01 C9 45 8A 01 }
        $mutex = { 48 89 EB 83 E3 ?? 45 8A 2C 1C 45 32 2C 2E 45 0F B6 FD }
        $str_decrypt = { 39 C2 7E ?? 49 89 C1 41 83 E1 ?? 47 8A 1C 0A 44 32 1C 01 45 88 1C 00 48 FF C0 }
        $payload_decrypt = { 4C 89 C8 83 E0 0F 41 8A 14 02 43 30 14 0F 49 FF C1 44 39 CB }
        $url = "/v1/updates/check?build=payloads" ascii fullword
    condition:
        3 of them
}
Download all Yara Rules