phexia | 7eb006665b9a897ce6b6c1051043598a4033d80f9610597300849b5e18437831

General

Target
7eb006665b9a897ce6b6c1051043598a4033d80f9610597300849b5e18437831
Size 3KB
Sample260925-sn4edsyfrf
SHA256 7eb006665b9a897ce6b6c1051043598a4033d80f9610597300849b5e18437831
MD5 adb82379bde9ca407f9630502502b21a
SHA1 3bd27ef0f1629af1107c8f4e9a107b6237cd3726
SHA512 c81d1f7ddd82cf49c24536cf9ce396283fab333595c7cd1117c407375be86e1abd5f03435529fe9da1606fb3613e940c323b64a9900a865fffcba26a0fc9e147
TLSH
T11A81C7ACAE0CFA4A4CA04C65B4BD3EC4037D128FEC7652DD6C5973519134694C6C9E34
MD5 SHA1 SHA512 TLSH

Score

10^/10

backdoor phexia

Family: Phexia
Phexia is a macOS AppleScript backdoor that resolves its C2 through a dead drop resolver and executes operator-supplied osascript modules.
backdoor phexia

Detects Phexia loader 1 IoCs

resource	yara_rule
sample	family_phexia_loader

SHA256 7eb006665b9a897ce6b6c1051043598a4033d80f9610597300849b5e18437831
MD5 adb82379bde9ca407f9630502502b21a
SHA1 3bd27ef0f1629af1107c8f4e9a107b6237cd3726
SHA512 c81d1f7ddd82cf49c24536cf9ce396283fab333595c7cd1117c407375be86e1abd5f03435529fe9da1606fb3613e940c323b64a9900a865fffcba26a0fc9e147
TLSH
T11A81C7ACAE0CFA4A4CA04C65B4BD3EC4037D128FEC7652DD6C5973519134694C6C9E34
MD5 SHA1 SHA512 TLSH