PHOREALMalware
- rizzo
Phoreal is a very simple backdoor that is capable of creating a reverse shell, performing simple file I/O and top-level window enumeration. It communicates to a list of four preconfigured C2 servers via ICMP on port 53From MISP Galaxy
Last reported 4 months ago, by ESET WeLiveSecurity (ES)4 reports
ATT&CK techniques
6 of 25 · each with the sentence it comes from- T1036Masquerading
“T1036”
- T1055Process Injection
“T1055”
- T1021Remote Services
“T1021”
- T1027Obfuscated Files or Information
“T1027”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1059Command and Scripting Interpreter
“T1059”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
OceanLotus: del espionaje exterior al foco en objetivos en Vietnam“…ocidas se encuentran Denis (también conocido como SOUNDBITE), que implementa tunelización DNS para comunicaciones de C&C; PHOREAL, que utiliza el protocolo ICMP para comunicaciones de C&C; WINDSHIELD, que incorpora un interesante mecanismo de evasión de proxy…”
-
OceanLotus: From external espionage to domestic targeting“Its well-known tools include Denis (aka SOUNDBITE), implementing DNS tunneling for C&C communications; PHOREAL, which leverages the ICMP protocol for C&C communications; WINDSHIELD, which features an interesting proxy bypass mechanism; and its latest backdoor, SPECTRALVIPER, whic…”
-
Elastic charms SPECTRALVIPER“One of these endpoints was previously infected with the PHOREAL implant, while the other endpoint was compromised with PIPEDANCE.”
-
PHOREAL Malware Targets the Southeast Asian Financial Sector“PHOREAL Malware Targets the Southeast Asian Financial Sector”
Indicators in its reports
named in the reports above- metakit.fireant[.]vnin 2 reports
- hxxp://metakit.fireant[.]vn/Software/version.xmlin 2 reports
- 139.162.11[.]152in 2 reports
- 142.91.98[.]77in 2 reports
- hxxps://financemachinelearning[.]com/apparatus/wind/twig/statement.htmlin 2 reports
- financemachinelearning[.]comin 2 reports
- gatewayrvcenter[.]comin 2 reports
- 139.180.128[.]42in 2 reports
- coachcybersecurity[.]comin 2 reports
- 139.99.33[.]239in 2 reports
- mxprodesign[.]comin 2 reports
- 166.88.77[.]186in 2 reports
- power-sync-services[.]comin 2 reports
- 103.119.47[.]104in 2 reports
- 511b77459673ec42…1d233b6c39fbin 2 reports
- 59a8553a4f8130f5…0be4d4da0e98in 2 reports
- 9ca1a5c7f79882db…26bcdcb9f6ddin 2 reports
- a8e2bbbfcb865003…12755ab0c165in 2 reports
- f74f1feb62b662cd…27824e55acb9in 2 reports
- f8f8209987ca7f13…e21bd2ae93a9in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.