phexia | ac183f102fdc2a7e5311dec8f1f3d43414b40879d36919aa1e456a886f372552

General

Target
ac183f102fdc2a7e5311dec8f1f3d43414b40879d36919aa1e456a886f372552
Size 18KB
Sample260925-sn5bpaygja
SHA256 ac183f102fdc2a7e5311dec8f1f3d43414b40879d36919aa1e456a886f372552
MD5 c0bd1baa392a3cb90df5be8cae368a70
SHA1 575387998340f4874d2384760fc31c431689f300
SHA512 efd1275eba1297ac4c9610e235b791373832c67646e0dc3a13625d28242c9595445ef382b1b567b1e05f9883c9bf8b0b5516779f22a7aaa960d94b7c5d7e5c26
SSDEEP 192:8nYUIsai8NKWI4VXEXd4rWoQatoUtqBYnQBsetqAmhAHIDclo:rUnQN/TWXMWf5s
TLSH
T10E82B5BE6FA0F9D85A14651B34F20D443650C0B7A2AC12FFA9CF72264F5E5386E9D812
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor phexia

Family: Phexia
Phexia is a macOS AppleScript backdoor that resolves its C2 through a dead drop resolver and executes operator-supplied osascript modules.
backdoor phexia

Detects Phexia loader 1 IoCs

resource	yara_rule
sample	family_phexia_loader

SHA256 ac183f102fdc2a7e5311dec8f1f3d43414b40879d36919aa1e456a886f372552
MD5 c0bd1baa392a3cb90df5be8cae368a70
SHA1 575387998340f4874d2384760fc31c431689f300
SHA512 efd1275eba1297ac4c9610e235b791373832c67646e0dc3a13625d28242c9595445ef382b1b567b1e05f9883c9bf8b0b5516779f22a7aaa960d94b7c5d7e5c26
SSDEEP 192:8nYUIsai8NKWI4VXEXd4rWoQatoUtqBYnQBsetqAmhAHIDclo:rUnQN/TWXMWf5s
TLSH
T10E82B5BE6FA0F9D85A14651B34F20D443650C0B7A2AC12FFA9CF72264F5E5386E9D812
MD5 SHA1 SHA512 SSDEEP TLSH