Overview

overview

10

Static

static

10

1270d03503...f5.exe

windows7_x64

10

1270d03503...f5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1270d03503499a3dc08a3d959ded61f5.exe

  • Size

    35KB

  • Sample

    210203-dxepvdwgp6

  • MD5

    1270d03503499a3dc08a3d959ded61f5

  • SHA1

    965b86352f0a5aea6969be8466e5318a0152b32a

  • SHA256

    329ea43f5027e79bb3151ce827fadbc6173a84218fd984ae4a4b44b478411339

  • SHA512

    418bda6ff2b2ca398372a7311605360e2e6f2506d083a26234bac19387e8ea60ad7c72fce35f439134fb70fb983f233e2748c868b75de61a40ff27cbe4a9984d

Score
10/10
phorphiexevasionloaderpersistencetrojanworm

Malware Config

Targets

    • Target

      1270d03503499a3dc08a3d959ded61f5.exe

    • Size

      35KB

    • MD5

      1270d03503499a3dc08a3d959ded61f5

    • SHA1

      965b86352f0a5aea6969be8466e5318a0152b32a

    • SHA256

      329ea43f5027e79bb3151ce827fadbc6173a84218fd984ae4a4b44b478411339

    • SHA512

      418bda6ff2b2ca398372a7311605360e2e6f2506d083a26234bac19387e8ea60ad7c72fce35f439134fb70fb983f233e2748c868b75de61a40ff27cbe4a9984d

    Score
    10/10
    phorphiexevasionloaderpersistencetrojanworm

    • Phorphiex Payload

    • Phorphiex Worm

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

      wormtrojanloaderphorphiex

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks