phorphiex | 96c57e456b9cd614a632edd4563ac70cb08fc34db2c2398c2c9aaa4ed920445f

Sharing

Copy URL Twitter E-mail

General

Target
96c57e456b9cd614a632edd4563ac70cb08fc34db2c2398c2c9aaa4ed920445f
Size 70KB
Sample220130-2whbkabfgk
SHA256 96c57e456b9cd614a632edd4563ac70cb08fc34db2c2398c2c9aaa4ed920445f
MD5 f60b2f25c72f60ce52d7c8abd3203e73
SHA1 665be01fa9e0fce4ac93492522f086daf707885c
SHA512 20487cab969831ecf585c984490971d06d8d8e066ab34358feec6133c6c81bdd418aefbc2d102bca0bc27153f2bce3431c456f2f810e52142e83a4e638019da3
SSDEEP 768:Q3MuYuJJXY8i5lbYKRgwJKY9tF9U1AxvjEk7LfCq5GTO0TBMcKzxCh6p1Cw2CPD:Q3Mz8RYfYA7BE2G5TxCotEDZfF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex Payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Phorphiex family
phorphiex

File Explorer

96c57e456b9cd614a632edd4563ac70cb08fc34db2c2398c2c9aaa4ed920445f

.exe 70KB

96c57e456b9cd614a632edd4563ac70cb08fc34db2c2398c2c9aaa4ed920445f

IMPHASH 2184d9d3a232034fe754f63f14b273e9
SHA256 96c57e456b9cd614a632edd4563ac70cb08fc34db2c2398c2c9aaa4ed920445f
MD5 f60b2f25c72f60ce52d7c8abd3203e73
SHA1 665be01fa9e0fce4ac93492522f086daf707885c
SHA512 20487cab969831ecf585c984490971d06d8d8e066ab34358feec6133c6c81bdd418aefbc2d102bca0bc27153f2bce3431c456f2f810e52142e83a4e638019da3
SSDEEP 768:Q3MuYuJJXY8i5lbYKRgwJKY9tF9U1AxvjEk7LfCq5GTO0TBMcKzxCh6p1Cw2CPD:Q3Mz8RYfYA7BE2G5TxCotEDZfF
MD5 SHA1 SHA512 SSDEEP

windows x86

Phorphiex Payload

Minor OS version

Major OS version

Entry point

22912

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

recvfrom setsockopt sendto bind WSAStartup send recv ioctlsocket WSACloseEvent WSARecv WSASend WSAGetLastError gethostname connect inet_ntoa inet_addr htons getsockname shutdown socket closesocket gethostbyname WSAEnumNetworkEvents WSAEventSelect listen WSAWaitForMultipleEvents getpeername accept WSAGetOverlappedResult WSACreateEvent WSASocketA

shlwapi

PathFileExistsW StrCmpNW PathMatchSpecW PathFindFileNameW StrChrA StrStrIA StrCmpNIA StrStrW

urlmon

URLDownloadToFileW

wininet

HttpOpenRequestA InternetOpenUrlW InternetOpenUrlA HttpQueryInfoA InternetOpenW InternetCloseHandle InternetOpenA HttpSendRequestA InternetConnectA InternetCrackUrlA InternetReadFile HttpAddRequestHeadersA

ntdll

memcpy _chkstk _aulldiv RtlUnwind mbstowcs RtlTimeToSecondsSince1980 NtQuerySystemTime NtQueryVirtualMemory memmove isdigit isalpha _allshl _aullshr memset

msvcrt

rand srand _vscprintf

kernel32

CreateEventA CreateProcessW GetLocaleInfoA DuplicateHandle DeleteCriticalSection GetThreadPriority SetThreadPriority GetCurrentThread GetCurrentProcess InterlockedExchangeAdd InterlockedIncrement InterlockedExchange WaitForSingleObject InterlockedDecrement GetCurrentProcessId HeapSetInformation GetSystemInfo PostQueuedCompletionStatus GetProcessHeaps HeapValidate HeapCreate HeapFree HeapAlloc HeapReAlloc ExpandEnvironmentStringsW CreateThread CreateMutexA GetLastError ExitProcess GetVolumeInformationW SetFileAttributesW GetQueuedCompletionStatus CreateIoCompletionPort SetEvent lstrcpyW DeleteFileW GetDiskFreeSpaceExW FindNextFileW lstrcmpiW QueryDosDeviceW RemoveDirectoryW FindClose lstrcmpW lstrlenA GlobalLock GetModuleHandleW GetTickCount GlobalAlloc Sleep lstrcpynW ExitThread MultiByteToWideChar lstrlenW GlobalUnlock GetFileSize MapViewOfFile UnmapViewOfFile WriteFile InitializeCriticalSection LeaveCriticalSection CreateFileW FlushFileBuffers EnterCriticalSection CreateFileMappingW CloseHandle FindFirstFileW GetDriveTypeW MoveFileExW CreateDirectoryW GetLogicalDrives CopyFileW GetModuleFileNameW

user32

TranslateMessage RegisterClassExW wsprintfW GetClipboardData EmptyClipboard ChangeClipboardChain SetWindowLongW DefWindowProcA RegisterRawInputDevices SendMessageA IsClipboardFormatAvailable CloseClipboard GetMessageA wsprintfA wvsprintfA GetWindowLongW CreateWindowExW DispatchMessageA OpenClipboard SetClipboardData SetClipboardViewer

advapi32

RegSetValueExW CryptGenRandom CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExA RegSetValueExA RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysAllocString SysFreeString