phoenixstealer

General

Target

28166889.exe
Size

5.2MB
Sample

220319-fyp9ascdhn
MD5

d6400095bffdf07603da238051f31bd4
SHA1

12d517d298cff39d493d1de9e6da6e24c0b4f5ac
SHA256

1c524c438438a2998e6f47513a8b639dc7f9c1ea649085bea77b2509f5e62dd5
SHA512

fbbdf4cbde7bcd5f859bcbb6da10e2bf892e34cba4178c1f99b150a65aeb743871709535b044904b806b68b4e2051c31445ccf4a10a26b25e192c8eb55cfa2a2

Score

10^/10

Malware Config

Targets

- Target
  
  28166889.exe
- Size
  
  5.2MB
- MD5
  
  d6400095bffdf07603da238051f31bd4
- SHA1
  
  12d517d298cff39d493d1de9e6da6e24c0b4f5ac
- SHA256
  
  1c524c438438a2998e6f47513a8b639dc7f9c1ea649085bea77b2509f5e62dd5
- SHA512
  
  fbbdf4cbde7bcd5f859bcbb6da10e2bf892e34cba4178c1f99b150a65aeb743871709535b044904b806b68b4e2051c31445ccf4a10a26b25e192c8eb55cfa2a2
Score

10^/10

phoenixstealer evasion stealer themida trojan
- PhoenixStealer
  PhoenixStealer is an information stealer written in the C++, it sends the stolen information to cybercriminals.
  stealer phoenixstealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Executes dropped EXE

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2