phorphiex | d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1

Sharing

Copy URL Twitter E-mail

General

Target
d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1
Size 70KB
Sample220130-2pdd2abegn
SHA256 d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1
MD5 1f6e817f7722e3d830d1bfe27386c346
SHA1 d6a6ae7efa933ab1cb3dcf3a740d6de947281432
SHA512 55ca3b8d0a51609c9b9ac48b11d69d01b2dd8593856a00ce087cf8f74de1d98fb8c13d4b1bd8ccfbd9bc11492d125ceb68d760fb3b6a0f016677bcf8725f7cf0
SSDEEP 768:y3MuYuJJXY8y5HpYapoxis49tF9U1Qh/Xc8bEHG18UV9pCzP6g6OKQ2Cnwa/JmM:y3Mz8VQurg79c+D1+fssNgMGfF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex Payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Phorphiex family
phorphiex

File Explorer

d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1

.exe 70KB

d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1

IMPHASH 2184d9d3a232034fe754f63f14b273e9
SHA256 d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1
MD5 1f6e817f7722e3d830d1bfe27386c346
SHA1 d6a6ae7efa933ab1cb3dcf3a740d6de947281432
SHA512 55ca3b8d0a51609c9b9ac48b11d69d01b2dd8593856a00ce087cf8f74de1d98fb8c13d4b1bd8ccfbd9bc11492d125ceb68d760fb3b6a0f016677bcf8725f7cf0
SSDEEP 768:y3MuYuJJXY8y5HpYapoxis49tF9U1Qh/Xc8bEHG18UV9pCzP6g6OKQ2Cnwa/JmM:y3Mz8VQurg79c+D1+fssNgMGfF
MD5 SHA1 SHA512 SSDEEP

windows x86

Phorphiex Payload

Minor OS version

Major OS version

Entry point

22944

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

recvfrom setsockopt sendto bind WSAStartup send recv ioctlsocket WSACloseEvent WSARecv WSASend WSAGetLastError gethostname connect inet_ntoa inet_addr htons getsockname shutdown socket closesocket gethostbyname WSAEnumNetworkEvents WSAEventSelect listen WSAWaitForMultipleEvents getpeername accept WSAGetOverlappedResult WSACreateEvent WSASocketA

shlwapi

PathFileExistsW StrCmpNW PathMatchSpecW PathFindFileNameW StrChrA StrStrIA StrCmpNIA StrStrW

urlmon

URLDownloadToFileW

wininet

HttpOpenRequestA InternetOpenUrlW InternetOpenUrlA HttpQueryInfoA InternetOpenW InternetCloseHandle InternetOpenA HttpSendRequestA InternetConnectA InternetCrackUrlA InternetReadFile HttpAddRequestHeadersA

ntdll

memcpy _chkstk _aulldiv RtlUnwind mbstowcs RtlTimeToSecondsSince1980 NtQuerySystemTime NtQueryVirtualMemory memmove isdigit isalpha _allshl _aullshr memset

msvcrt

rand srand _vscprintf

kernel32

CreateEventA CreateProcessW GetLocaleInfoA DuplicateHandle DeleteCriticalSection GetThreadPriority SetThreadPriority GetCurrentThread GetCurrentProcess InterlockedExchangeAdd InterlockedIncrement InterlockedExchange WaitForSingleObject InterlockedDecrement GetCurrentProcessId HeapSetInformation GetSystemInfo PostQueuedCompletionStatus GetProcessHeaps HeapValidate HeapCreate HeapFree HeapAlloc HeapReAlloc ExpandEnvironmentStringsW CreateThread CreateMutexA GetLastError ExitProcess GetVolumeInformationW SetFileAttributesW GetQueuedCompletionStatus CreateIoCompletionPort SetEvent lstrcpyW DeleteFileW GetDiskFreeSpaceExW FindNextFileW lstrcmpiW QueryDosDeviceW RemoveDirectoryW FindClose lstrcmpW lstrlenA GlobalLock GetModuleHandleW GetTickCount GlobalAlloc Sleep lstrcpynW ExitThread MultiByteToWideChar lstrlenW GlobalUnlock GetFileSize MapViewOfFile UnmapViewOfFile WriteFile InitializeCriticalSection LeaveCriticalSection CreateFileW FlushFileBuffers EnterCriticalSection CreateFileMappingW CloseHandle FindFirstFileW GetDriveTypeW MoveFileExW CreateDirectoryW GetLogicalDrives CopyFileW GetModuleFileNameW

user32

TranslateMessage RegisterClassExW wsprintfW GetClipboardData EmptyClipboard ChangeClipboardChain SetWindowLongW DefWindowProcA RegisterRawInputDevices SendMessageA IsClipboardFormatAvailable CloseClipboard GetMessageA wsprintfA wvsprintfA GetWindowLongW CreateWindowExW DispatchMessageA OpenClipboard SetClipboardData SetClipboardViewer

advapi32

RegSetValueExW CryptGenRandom CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExA RegSetValueExA RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysAllocString SysFreeString