phoenixstealer

General

Target

22.exe
Size

2.3MB
Sample

220416-f6gbcscacl
MD5

11fdf8c21d2059cccce0645934e29943
SHA1

77d4de585b06c62bc2ed71393cb2d6fec4bb464d
SHA256

54f4ec503268ddc6c926d59ab37dadd1455c9cab3ba3947d1aa3c58fa6aca308
SHA512

38238dbcd3cb5577753149311685d42d40dcee82b25158a9a8c7f5037186d5b68907fce4e24c64dc369465ac4390e503d48ad0ecf255200275c3de6a3549e665

Score

10^/10

Malware Config

Targets

- Target
  
  22.exe
- Size
  
  2.3MB
- MD5
  
  11fdf8c21d2059cccce0645934e29943
- SHA1
  
  77d4de585b06c62bc2ed71393cb2d6fec4bb464d
- SHA256
  
  54f4ec503268ddc6c926d59ab37dadd1455c9cab3ba3947d1aa3c58fa6aca308
- SHA512
  
  38238dbcd3cb5577753149311685d42d40dcee82b25158a9a8c7f5037186d5b68907fce4e24c64dc369465ac4390e503d48ad0ecf255200275c3de6a3549e665
Score

10^/10

redline discovery infostealer spyware stealer phoenixstealer persistence
- PhoenixStealer
  PhoenixStealer is an information stealer written in the C++, it sends the stolen information to cybercriminals.
  stealer phoenixstealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Blocklisted process makes network request
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Tasks

Sharing

General

Malware Config

Targets

RedLine

RedLine Payload

Blocklisted process makes network request

Executes dropped EXE

Checks computer location settings

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2