phorphiex | 96de9c78028eaec7cd06d8e3e755ffc4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
96de9c78028eaec7cd06d8e3e755ffc4.exe
Size 75KB
Sample220906-gla5aafhe3
SHA256 d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
MD5 96de9c78028eaec7cd06d8e3e755ffc4
SHA1 612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA512 5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
SSDEEP 1536:K3Mz8j5ZOooa0kCOrtEH1jBfSuh7wi5FLDtC:xwNZO3OpQ1VfPEi5Fft
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Extracted

Family

phorphiex

http://185.215.113.66/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Signatures

Phorphiex family
phorphiex

File Explorer

96de9c78028eaec7cd06d8e3e755ffc4.exe

.exe 75KB

96de9c78028eaec7cd06d8e3e755ffc4.exe

IMPHASH 2f2316fb946682a102e453a8ae405904
SHA256 d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
MD5 96de9c78028eaec7cd06d8e3e755ffc4
SHA1 612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA512 5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
SSDEEP 1536:K3Mz8j5ZOooa0kCOrtEH1jBfSuh7wi5FLDtC:xwNZO3OpQ1VfPEi5Fft
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

23152

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

recvfrom setsockopt sendto bind WSAStartup ioctlsocket recv send WSACloseEvent WSARecv WSASend WSAGetLastError WSAEnumNetworkEvents gethostname connect inet_ntoa inet_addr htons getsockname shutdown socket closesocket gethostbyname WSAEventSelect WSAGetOverlappedResult WSAWaitForMultipleEvents getpeername accept WSACreateEvent WSASocketA listen

shlwapi

PathFileExistsW StrCmpNW PathMatchSpecW PathFindFileNameW PathFileExistsA StrChrA StrStrIA StrCmpNIA StrStrW

urlmon

URLDownloadToFileW

wininet

InternetConnectA InternetOpenUrlW HttpQueryInfoA InternetOpenW HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle InternetCrackUrlA

ntdll

memcpy _chkstk _aulldiv RtlUnwind memmove mbstowcs RtlTimeToSecondsSince1980 NtQuerySystemTime NtQueryVirtualMemory strstr isdigit isalpha _allshl _aullshr memset

msvcrt

rand srand _vscprintf

kernel32

MoveFileW CreateProcessW GetLocaleInfoA DuplicateHandle DeleteCriticalSection GetThreadPriority SetThreadPriority GetCurrentThread GetCurrentProcess InterlockedExchangeAdd InterlockedIncrement InterlockedExchange WaitForSingleObject InterlockedDecrement GetCurrentProcessId HeapSetInformation GetProcessHeaps GetSystemInfo PostQueuedCompletionStatus HeapValidate HeapCreate HeapFree HeapAlloc HeapReAlloc ExpandEnvironmentStringsW CreateThread DeleteFileA CreateMutexA MoveFileA GetLastError CreateEventA ExitProcess GetQueuedCompletionStatus CreateIoCompletionPort SetEvent GetVolumeInformationW SetFileAttributesW lstrcpyW DeleteFileW GetDiskFreeSpaceExW FindNextFileW lstrcmpiW QueryDosDeviceW RemoveDirectoryW FindClose lstrlenA GlobalLock GetModuleHandleW GetTickCount GlobalAlloc Sleep lstrcpynW ExitThread MultiByteToWideChar lstrlenW GlobalUnlock GetFileSize MapViewOfFile UnmapViewOfFile WriteFile InitializeCriticalSection LeaveCriticalSection CreateFileW FlushFileBuffers EnterCriticalSection CreateFileMappingW CloseHandle FindFirstFileW GetDriveTypeW MoveFileExW CreateDirectoryW GetLogicalDrives CopyFileW GetModuleFileNameW lstrcmpW

user32

SendMessageA wsprintfW IsClipboardFormatAvailable RegisterClassExW GetWindowLongW GetClipboardData EmptyClipboard ChangeClipboardChain SetWindowLongW CloseClipboard GetMessageA FindWindowA ShowWindow wsprintfA SetForegroundWindow wvsprintfA TranslateMessage DefWindowProcA RegisterRawInputDevices CreateWindowExW DispatchMessageA OpenClipboard SetClipboardData SetClipboardViewer

advapi32

RegSetValueExW CryptGenRandom CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExA RegSetValueExA RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysFreeString SysAllocString