Overview

overview

10

Static

static

a1e6dc9922...05.exe

windows7_x64

10

a1e6dc9922...05.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1e6dc9922fbe045c11f087b67d4ea05

  • Size

    1.0MB

  • Sample

    201117-3gspcxz7k2

  • MD5

    6d99bee371359b0d520b4aa4e4a7ff03

  • SHA1

    3ed8c8dbe6f962371aa27fa2faee30018789ae76

  • SHA256

    77e500161161d047b1fc9dcba58f3422ad838b99b5c318972d33390be6d1d69c

  • SHA512

    1ccebe7f12e81092e20a504d59dc86bc824e1b749637b6f1319a2769ac6e65b9cd1c45addd0097ea7593448c7a1020d9a96455d09e09aa5987667ef28944e4c1

Score
10/10
phorphiexevasionloaderpersistencetrojanworm

Malware Config

Targets

    • Target

      a1e6dc9922fbe045c11f087b67d4ea05

    • Size

      1.0MB

    • MD5

      6d99bee371359b0d520b4aa4e4a7ff03

    • SHA1

      3ed8c8dbe6f962371aa27fa2faee30018789ae76

    • SHA256

      77e500161161d047b1fc9dcba58f3422ad838b99b5c318972d33390be6d1d69c

    • SHA512

      1ccebe7f12e81092e20a504d59dc86bc824e1b749637b6f1319a2769ac6e65b9cd1c45addd0097ea7593448c7a1020d9a96455d09e09aa5987667ef28944e4c1

    Score
    10/10
    phorphiexevasionloaderpersistencetrojanworm

    • Phorphiex Payload

    • Phorphiex Worm

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

      wormtrojanloaderphorphiex

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks