General
-
Target
Phoenix.exe
-
Size
415KB
-
Sample
230402-afmgssde95
-
MD5
2807ce367d65d1d80ea563097d7a7a23
-
SHA1
650bdea392dac369a877bbd032c82ff175fe69a6
-
SHA256
a8ebc2f5c78093046ccdc96ed499b3bd263e95b53747ccec408858af6805bf82
-
SHA512
17612c7d624f18b7d9126a9938b13490a13196a804286f45f3dfd497ce89ebde707e55670e5571650bd6d72db8deb45d5994e1fd1a6aaaf0c2e5ef76ed669a72
-
SSDEEP
6144:rDTojL6Ed0YXwBx1X2gTiPHqAZ/exrdKV2:rDToXd0YOX2aQYxRKV2
Static task
static1
Behavioral task
behavioral1
Sample
Phoenix.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Phoenix.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
Phoenix.exe
-
Size
415KB
-
MD5
2807ce367d65d1d80ea563097d7a7a23
-
SHA1
650bdea392dac369a877bbd032c82ff175fe69a6
-
SHA256
a8ebc2f5c78093046ccdc96ed499b3bd263e95b53747ccec408858af6805bf82
-
SHA512
17612c7d624f18b7d9126a9938b13490a13196a804286f45f3dfd497ce89ebde707e55670e5571650bd6d72db8deb45d5994e1fd1a6aaaf0c2e5ef76ed669a72
-
SSDEEP
6144:rDTojL6Ed0YXwBx1X2gTiPHqAZ/exrdKV2:rDToXd0YOX2aQYxRKV2
Score8/10-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-