good

General
Target

good

Size

143KB

Sample

201105-yhb3bs35rs

Score
10 /10
MD5

b034e2a7cd76b757b7c62ce514b378b4

SHA1

27d15f36cb5e3338a19a7f6441ece58439f830f2

SHA256

90d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac

SHA512

1cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385

Malware Config
Targets
Target

good

MD5

b034e2a7cd76b757b7c62ce514b378b4

Filesize

143KB

Score
10 /10
SHA1

27d15f36cb5e3338a19a7f6441ece58439f830f2

SHA256

90d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac

SHA512

1cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385

Tags

Signatures

  • Modifies Windows Defender Real-time Protection settings

    Tags

    TTPs

    Modify Registry Modify Existing Service Disabling Security Tools
  • Phorphiex Worm

    Description

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    Tags

  • Windows security bypass

    Tags

    TTPs

    Disabling Security Tools Modify Registry
  • Executes dropped EXE

  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

  • Loads dropped DLL

  • Windows security modification

    Tags

    TTPs

    Disabling Security Tools Modify Registry
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation