Loading malware…
Phoenix Keylogger is a Windows information stealer written in VB.NET that emerged in July 2019 and is sold through a malware-as-a-service model. Marketed in underground communities by an actor using the handle Illusion, it combines keystroke logging with credential theft, clipboard collection, screenshot capture, and the ability to download additional malware. It steals sensitive data from numerous web browsers, email clients, FTP clients, and chat clients. Observed payloads have also collected cryptocurrency wallet data and MetaMask information.
Phoenix profiles compromised systems by collecting operating-system, hardware, user, and running-process information. It supports exfiltration through SMTP, FTP, and Telegram using preconfigured collection and transmission settings rather than a conventional interactive command-and-control model. Its defense-evasion features include encrypted strings, obfuscation, anti-debugging and anti-virtualization checks, attempts to disable Windows Defender, and a module that attempts to terminate processes associated with more than 80 security and analysis tools. Most analyzed samples did not establish persistence.
Common delivery mechanisms include phishing and malicious spam carrying weaponized RTF or Microsoft Office documents that exploit CVE-2017-11882. Phoenix has also been distributed by PrivateLoader and through Telegram lures impersonating a tool for conducting DDoS attacks against Russian targets. In the latter campaign, a packed dropper injected the Phoenix payload into a legitimate .NET Framework process. Victims have been observed across North America, Europe, and the Middle East.
This information-stealing family is distinct from other threats sharing the Phoenix name, including an Evil Corp ransomware brand, an exploit kit, Android malware, and a backdoor associated with MuddyWater.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The majority of Phoenix infections we observe originate from phishing attempts that leverage a weaponized rich text file (RTF) or Microsoft Office document. These deliveries do not use the more popular malicious macro technique, but instead use known exploits. Most commonly, they exploit the Equation Editor vulnerability (CVE-2017-11882). | Cybereason’s Nocturnus team is tracking a new keylogger gaining traction among cybercriminals called Phoenix. The keylogger first emerged in July 2019 packed with a myriad of information-stealing features.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Some of the ransomware names used are WastedLocker, Hades, and Phoenix.
MuddyWater ... pour diffuser des malwares comme « Phoenix, FakeUpdate, StealthCache et Chromium_Stealer ».
43 distinct techniques documented for this family, organized by ATT&CK tactic.
Phoenix’s various tasks like infostealing, downloading additional malware, and spreading via USB are predefined by the operators in the configuration file before compilation.
Phoenix has a set of features to disable different Windows tools within the admin panel, like disabling CMD, the registry, task manager, system restore, and others.
In this case, the regsvcs.exe is not used as a living off the land binary (LoLBin). It is injected with the malicious code, which consists of the Phoenix information stealer.
String Encryption: Most critical strings used by the malware are encrypted and only decrypted in memory. Obfuscation: The stub is obfuscated by what appears to be an implementation of the open source ConfuserEx .NET obfuscator...
Illusion recommends using an additional third-party crypter to “make it FUD”, or fully undetectable. It is worth noting that most Phoenix samples caught in the wild are packed with a crypter...
The victim’s data is encrypted with RC4 (key is podEID53t29v) + RC4.
In this case, the regsvcs.exe is not used as a living off the land binary (LoLBin). It is injected with the malicious code, which consists of the Phoenix information stealer.
Phoenix performs the checks and terminates itself if it discovers any of the following processes or files in the target machine.
Most critical strings used by the malware are encrypted and only decrypted in memory.
MSBuild is normally used to compile and execute coding projects; it can be passed project files or XML files containing scripts on the command line... Since the file is a trusted Microsoft binary, it can be packed into a dropper to mask the malicious nature of the malware.
After obtaining basic system information, Phoenix checks to see if it is running in a “hostile” environment... if Phoenix is deployed in a virtual machine, debugger, or on a machine with analysis tools or antivirus products installed.
For example, this is how the malware steals the phone’s unlock gesture: ... json.put("type", "unlock"); json.put("text", Access.this.gestureTexts.toString()); json.put("gesture", Access.this.currenGestureRecroding.toString());
Phoenix uses a common method of hooking keyboard events for its keylogging. It uses a Windows API function SetWindowsHookExA to map the pressed keys, then matches them to the corresponding process.
Attackers are increasingly turning to stealing the “cookies” associated with credentials to clone active or recent web sessions—bypassing MFA in the process.
Phoenix attempts to steal credentials and other sensitive information stored locally on the target machine by searching for specific files or registry keys that contain sensitive information.
Phoenix attempts to steal credentials and other sensitive information stored locally on the target machine by searching for specific files or registry keys that contain sensitive information. It searches browsers, mail clients, FTP clients, and chat clients.
Phoenix attempts to steal credentials and other sensitive information stored locally on the target machine by searching for specific files or registry keys that contain sensitive information.
Phoenix checks for Internet connectivity and obtains the external IP address of the target machine by sending a GET HTTP request to ifconfig.me...
Once Phoenix successfully infects the target machine, it profiles the machine to gather information on the operating system, hardware, running processes, users, and its external IP.
Once Phoenix successfully infects the target machine, it profiles the machine to gather information on the operating system, hardware, running processes, users, and its external IP.
Once Phoenix successfully infects the target machine, it profiles the machine to gather information on the operating system, hardware, running processes, users, and its external IP.
Phoenix performs the checks and terminates itself if it discovers any of the following processes or files in the target machine.
Phoenix stores the information in memory and sends it back to the attackers directly, without writing it to disk.
For example, this is how the malware steals the phone’s unlock gesture: ... json.put("type", "unlock"); json.put("text", Access.this.gestureTexts.toString()); json.put("gesture", Access.this.currenGestureRecroding.toString());
Phoenix uses a common method of hooking keyboard events for its keylogging. It uses a Windows API function SetWindowsHookExA to map the pressed keys, then matches them to the corresponding process.
We also found other malware samples communicating with this command and control (C2) IP address.
The malware communicates to a remote server 135.181.11.14 via 2 different channels: 1. Via HTTP, on port 4000. 2. Via a web socket, on port 8000
Phoenix offers common SMTP and FTP exfiltration protocols, but also supports data exfiltration over Telegram.
This information is then sent to a remote IP address, in this case, a Russian IP — 95[.]142.46.35 — on port 6666. As shown in the deobfuscated screen capture below, the information, which is sent with a simple base64 encoding... Following the summary, a ZIP file of the stolen data is also uploaded to the server
96 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a previous Android threat family that Perseus builds upon.
Referenced as a malware codebase directly used in the development of Perseus.
A custom backdoor used to maintain long-term persistent access in compromised environments for espionage purposes.
Custom backdoor used in Seedworm spear-phishing campaigns (malicious Office attachments) to enable persistent access and intelligence collection against government and international organizations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.