General
-
Target
Phoenix.exe
-
Size
415KB
-
Sample
230402-basbjafb2w
-
MD5
2807ce367d65d1d80ea563097d7a7a23
-
SHA1
650bdea392dac369a877bbd032c82ff175fe69a6
-
SHA256
a8ebc2f5c78093046ccdc96ed499b3bd263e95b53747ccec408858af6805bf82
-
SHA512
17612c7d624f18b7d9126a9938b13490a13196a804286f45f3dfd497ce89ebde707e55670e5571650bd6d72db8deb45d5994e1fd1a6aaaf0c2e5ef76ed669a72
-
SSDEEP
6144:rDTojL6Ed0YXwBx1X2gTiPHqAZ/exrdKV2:rDToXd0YOX2aQYxRKV2
Static task
static1
Behavioral task
behavioral1
Sample
Phoenix.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
Phoenix.exe
-
Size
415KB
-
MD5
2807ce367d65d1d80ea563097d7a7a23
-
SHA1
650bdea392dac369a877bbd032c82ff175fe69a6
-
SHA256
a8ebc2f5c78093046ccdc96ed499b3bd263e95b53747ccec408858af6805bf82
-
SHA512
17612c7d624f18b7d9126a9938b13490a13196a804286f45f3dfd497ce89ebde707e55670e5571650bd6d72db8deb45d5994e1fd1a6aaaf0c2e5ef76ed669a72
-
SSDEEP
6144:rDTojL6Ed0YXwBx1X2gTiPHqAZ/exrdKV2:rDToXd0YOX2aQYxRKV2
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-