phorphiex | f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066

General

Target
f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066
Size 215KB
Sample220520-rach3sfca4
SHA256 f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066
MD5 ab97f71125a89d4d3d0855b8a419d3e1
SHA1 2442d4a7cfbe7fd22708034c853faf9aa4337907
SHA512 5abcab63f953a04d4c4a0eeb38f1716003fdecd2a8b465687e39f5bd492efe587bff06fedcc0724246f59a0b1e799765a6e49169b17728960c2cb066236f6038
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066
- Size 215KB
- SHA256 f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066
- MD5 ab97f71125a89d4d3d0855b8a419d3e1
- SHA1 2442d4a7cfbe7fd22708034c853faf9aa4337907
- SHA512 5abcab63f953a04d4c4a0eeb38f1716003fdecd2a8b465687e39f5bd492efe587bff06fedcc0724246f59a0b1e799765a6e49169b17728960c2cb066236f6038
- MD5 SHA1 SHA512
Score

10^/10

phorphiex evasion loader persistence suricata trojan worm
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Phorphiex Payload
- Phorphiex Worm
  Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  evasion trojan
- suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
  suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
  suricata
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies Windows Defender Real-time Protection settings

Phorphiex Payload

Phorphiex Worm

Windows security bypass

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2