Loading malware…
Phoenix is a malware name used for multiple distinct families, most prominently a Windows VB.NET information stealer/keylogger active since 2019, an Android remote-access and banking malware lineage derived from Cerberus, and a later custom backdoor associated with the Iranian threat group MuddyWater. Because the same name is applied to unrelated malware, attribution and classification require platform and campaign context.
The best-documented Phoenix variant on Windows is a malware-as-a-service infostealer and keylogger written in VB.NET. It emerged in 2019 and was marketed in underground communities as a low-cost commodity stealer. Its capabilities include credential theft from numerous browsers, mail clients, FTP software, and chat clients; keylogging; clipboard theft; screenshot capture; host profiling; and downloading additional payloads. It has also been observed stealing browser cookies and cryptocurrency-related data in some campaigns. Exfiltration has been reported over channels including SMTP, FTP, Telegram, and direct network upload. Anti-analysis and defense-evasion features include obfuscation, encrypted strings, anti-debugging, anti-VM checks, attempts to disable Microsoft Defender, and process termination targeting security tools. Delivery has been strongly associated with phishing and malspam, including weaponized Office or RTF documents exploiting CVE-2017-11882, as well as lure-based distribution through fake tools and malware delivery services. Researchers have linked this Windows Phoenix to the earlier Alpha keylogger and noted code similarities with other commodity .NET stealers such as Snake, Matiex, 404, and Cheetah.
A separate Android Phoenix family has been described both as a remote access trojan and as a banking trojan lineage. Android Phoenix abuses Accessibility Services and device administration privileges to spy on victims, steal SMS messages, capture screenshots, log input, harvest unlock patterns, and support remote interaction. Reporting in 2024 identified Phoenix as a Cerberus-derived banking trojan sold on underground forums, while reverse engineering of Android/Phoenix samples showed dynamic module loading, command handling, and surveillance-oriented functionality. Related reporting indicates Phoenix code also informed later Android malware such as Perseus.
Phoenix is also the name of a custom backdoor used by MuddyWater, an Iranian state-aligned espionage actor also tracked as Seedworm, Mango Sandstorm, Static Kitten, and TA450. From 2025 onward, MuddyWater was observed delivering Phoenix through malicious documents with macros and spearphishing campaigns, including operations targeting North African energy organizations and broader MENA government and international targets. In this context, Phoenix functions as a .NET or PowerShell-associated backdoor used for persistent access, intelligence collection, and follow-on intrusion activity as part of MuddyWater’s broader custom implant ecosystem.
Separately, “Phoenix” has also appeared as a ransomware brand name in reporting on Evil Corp rebranding, but that usage refers to an operation name rather than a clearly defined standalone malware family in the same sense as the Windows stealer, Android trojan, or MuddyWater backdoor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The majority of Phoenix infections we observe originate from phishing attempts that leverage a weaponized rich text file (RTF) or Microsoft Office document. These deliveries do not use the more popular malicious macro technique, but instead use known exploits. Most commonly, they exploit the Equation Editor vulnerability (CVE-2017-11882). | Cybereason’s Nocturnus team is tracking a new keylogger gaining traction among cybercriminals called Phoenix. The keylogger first emerged in July 2019 packed with a myriad of information-stealing features.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
After the US Department of the Treasury Office of Foreign Asset Control (OFAC) sanctioned Evil Corp over Dridex in December, 2019, the group went through a rapid set of name and branding changes to their ransomware, cycling through many names including WastedLocker, Hades, Phoenix, Grief, Macaw, and now, possibly, Entropy.
MuddyWater ... pour diffuser des malwares comme « Phoenix, FakeUpdate, StealthCache et Chromium_Stealer ».
43 distinct techniques documented for this family, organized by ATT&CK tactic.
Phoenix’s various tasks like infostealing, downloading additional malware, and spreading via USB are predefined by the operators in the configuration file before compilation.
Phoenix has a set of features to disable different Windows tools within the admin panel, like disabling CMD, the registry, task manager, system restore, and others.
The page it displays is loaded as a WebView, whose HTML content is base64 decoded from a hard-coded resource string... webView0.addJavascriptInterface(new WebAppInterface(this, this), this.consts.string_1);
String Encryption: Most critical strings used by the malware are encrypted and only decrypted in memory. Obfuscation: The stub is obfuscated by what appears to be an implementation of the open source ConfuserEx .NET obfuscator...
Illusion recommends using an additional third-party crypter to “make it FUD”, or fully undetectable. It is worth noting that most Phoenix samples caught in the wild are packed with a crypter...
The victim’s data is encrypted with RC4 (key is podEID53t29v) + RC4.
In this case, the regsvcs.exe is not used as a living off the land binary (LoLBin). It is injected with the malicious code, which consists of the Phoenix information stealer.
Phoenix performs the checks and terminates itself if it discovers any of the following processes or files in the target machine.
Most critical strings used by the malware are encrypted and only decrypted in memory.
MSBuild is normally used to compile and execute coding projects; it can be passed project files or XML files containing scripts on the command line... Since the file is a trusted Microsoft binary, it can be packed into a dropper to mask the malicious nature of the malware.
After obtaining basic system information, Phoenix checks to see if it is running in a “hostile” environment... if Phoenix is deployed in a virtual machine, debugger, or on a machine with analysis tools or antivirus products installed.
For example, this is how the malware steals the phone’s unlock gesture: ... json.put("type", "unlock"); json.put("text", Access.this.gestureTexts.toString()); json.put("gesture", Access.this.currenGestureRecroding.toString());
Phoenix uses a common method of hooking keyboard events for its keylogging. It uses a Windows API function SetWindowsHookExA to map the pressed keys, then matches them to the corresponding process.
Attackers are increasingly turning to stealing the “cookies” associated with credentials to clone active or recent web sessions—bypassing MFA in the process.
Phoenix attempts to steal credentials and other sensitive information stored locally on the target machine by searching for specific files or registry keys that contain sensitive information.
Phoenix attempts to steal credentials and other sensitive information stored locally on the target machine by searching for specific files or registry keys that contain sensitive information. It searches browsers, mail clients, FTP clients, and chat clients.
Phoenix attempts to steal credentials and other sensitive information stored locally on the target machine by searching for specific files or registry keys that contain sensitive information.
Phoenix checks for Internet connectivity and obtains the external IP address of the target machine by sending a GET HTTP request to ifconfig.me...
Once Phoenix successfully infects the target machine, it profiles the machine to gather information on the operating system, hardware, running processes, users, and its external IP.
Once Phoenix successfully infects the target machine, it profiles the machine to gather information on the operating system, hardware, running processes, users, and its external IP.
Once Phoenix successfully infects the target machine, it profiles the machine to gather information on the operating system, hardware, running processes, users, and its external IP.
Phoenix performs the checks and terminates itself if it discovers any of the following processes or files in the target machine.
Phoenix stores the information in memory and sends it back to the attackers directly, without writing it to disk.
For example, this is how the malware steals the phone’s unlock gesture: ... json.put("type", "unlock"); json.put("text", Access.this.gestureTexts.toString()); json.put("gesture", Access.this.currenGestureRecroding.toString());
We also found other malware samples communicating with this command and control (C2) IP address.
The malware communicates to a remote server 135.181.11.14 via 2 different channels: 1. Via HTTP, on port 4000. 2. Via a web socket, on port 8000
Phoenix offers common SMTP and FTP exfiltration protocols, but also supports data exfiltration over Telegram.
For the majority of cases, Phoenix posts the stolen data using the SMTP protocol. The stolen data is sent as an email to an email address controlled by the attacker.
This information is then sent to a remote IP address, in this case, a Russian IP — 95[.]142.46.35 — on port 6666. As shown in the deobfuscated screen capture below, the information, which is sent with a simple base64 encoding... Following the summary, a ZIP file of the stolen data is also uploaded to the server
80 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a previous Android threat family that Perseus builds upon.
Referenced as a malware codebase directly used in the development of Perseus.
A custom backdoor used to maintain long-term persistent access in compromised environments for espionage purposes.
Custom backdoor used in Seedworm spear-phishing campaigns (malicious Office attachments) to enable persistent access and intelligence collection against government and international organizations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.