General

  • Target

    2516c409db6d4634dcf3d303f4e7a3e4c6cec0806bf8055eaedf889a7f374ea5

  • Size

    368KB

  • Sample

    220611-yzhjysbae2

  • MD5

    f3dcf80b6251cfba1cd754006f693a73

  • SHA1

    8c0aeb4abf3346b5f9d086c47aea2975ec563a7c

  • SHA256

    2516c409db6d4634dcf3d303f4e7a3e4c6cec0806bf8055eaedf889a7f374ea5

  • SHA512

    1e38a303af1006a0f00470c5b925f444bce297e6f5925b6e970472bf577bdb55cab1d4ddd1d915ca68a945ea722f1164e88ccb9e639d6524921ab1a01edf5123

Malware Config

Extracted

Family

phorphiex

C2

http://193.32.161.73/

Wallets

1Bn4JYKoVgQpZ73doWVFSNZBbwKj3cpJNR

qqsagteh4m6qunmgrrknulafzcdlmzn35yeggvq8qk

Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i

D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M

0x05F916216CC4BA6ac89b8093d474E2a1e6121c63

LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7

t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z

Targets

    • Target

      2516c409db6d4634dcf3d303f4e7a3e4c6cec0806bf8055eaedf889a7f374ea5

    • Size

      368KB

    • MD5

      f3dcf80b6251cfba1cd754006f693a73

    • SHA1

      8c0aeb4abf3346b5f9d086c47aea2975ec563a7c

    • SHA256

      2516c409db6d4634dcf3d303f4e7a3e4c6cec0806bf8055eaedf889a7f374ea5

    • SHA512

      1e38a303af1006a0f00470c5b925f444bce297e6f5925b6e970472bf577bdb55cab1d4ddd1d915ca68a945ea722f1164e88ccb9e639d6524921ab1a01edf5123

    • Modifies Windows Defender Real-time Protection settings

    • Phorphiex

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    • Phorphiex payload

    • Windows security bypass

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks