Overview

overview

10

Static

static

10

Phoenix-Nuker.exe

windows10-ltsc_2021-x64

7

main.pyc

windows10-ltsc_2021-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Phoenix-Nuker.exe

  • Size

    17.9MB

  • Sample

    250331-rjjczstpz5

  • MD5

    bfefa239c8a99e0f3cd1e9cfeea7ef16

  • SHA1

    62c36544d88a15ac26de901a35e39874472638c5

  • SHA256

    ad764db8191b3cd576f25a8be8a028df7ee1fcd477c5c583f4ad7d515cbc0511

  • SHA512

    d36042a744bdafc527021662fa184086610a5292ae69bb35dda0c11812340fdf6b73b7eb5445bf2375928b6f74131e1b7cf18de9f502d4f8a12afb3b88a5889e

  • SSDEEP

    393216:nqPnLFXlrHQpDOETgsvfGmkgPAMYvNZX2MqY19:qPLFXNHQoE4C2E

Score
10/10
empyreandiscoverypersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      Phoenix-Nuker.exe

    • Size

      17.9MB

    • MD5

      bfefa239c8a99e0f3cd1e9cfeea7ef16

    • SHA1

      62c36544d88a15ac26de901a35e39874472638c5

    • SHA256

      ad764db8191b3cd576f25a8be8a028df7ee1fcd477c5c583f4ad7d515cbc0511

    • SHA512

      d36042a744bdafc527021662fa184086610a5292ae69bb35dda0c11812340fdf6b73b7eb5445bf2375928b6f74131e1b7cf18de9f502d4f8a12afb3b88a5889e

    • SSDEEP

      393216:nqPnLFXlrHQpDOETgsvfGmkgPAMYvNZX2MqY19:qPLFXNHQoE4C2E

    Score
    7/10
    discoverypersistenceprivilege_escalationspywarestealerupx

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

    • Target

      main.pyc

    • Size

      7KB

    • MD5

      c08e1894e52f7b21ebf5b9b4e1b8729d

    • SHA1

      483a9fbd906f99490570820dd1e030b51de40026

    • SHA256

      2b8838045c648f16de740a22d8376fb47f2339c354d26a2492242bbd590dbf01

    • SHA512

      31f930ec8aa4cb51f8c3dc4de330979fc79b77db207f4b1de8caa0f2135141ae579883e51810933bfe55d59d516f05d7e5a4fdb2af90340e900f09b6cf240099

    • SSDEEP

      192:wo5v2EgTRD8GXWdXwEshgFBJhw83WyMdwENyJnw:F5v2/WuFgh283WyPENcw

    Score
    3/10
    behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Information Discovery

1
T1082

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks