phorphiex

General

Target

tmp
Size

73KB
Sample

221221-h738mabg92
MD5

f9f4cefab2c0c41ba4ccce896aaa9e54
SHA1

3b18b09842ea1b4288def6d7416287d222967297
SHA256

764621435395609860a78ef6d107832fb9bb7f41f02c0bf11a180d9309c008aa
SHA512

e7ada22ce6127e4a660d11b78e90f9a94c75aa820ac6b73f3e4f64d65b076e58aea0afb0c3418eb3c6fa5754f0a9840cb1c2dd8069235544eec531a2dabe7cf3
SSDEEP

1536:83Mz8pr+ehOVEn/g9u1ti/jQWlCsv038L7wlfF:XwoehO0gArukWMsv0+ElfF

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Targets

- Target
  
  tmp
- Size
  
  73KB
- MD5
  
  f9f4cefab2c0c41ba4ccce896aaa9e54
- SHA1
  
  3b18b09842ea1b4288def6d7416287d222967297
- SHA256
  
  764621435395609860a78ef6d107832fb9bb7f41f02c0bf11a180d9309c008aa
- SHA512
  
  e7ada22ce6127e4a660d11b78e90f9a94c75aa820ac6b73f3e4f64d65b076e58aea0afb0c3418eb3c6fa5754f0a9840cb1c2dd8069235544eec531a2dabe7cf3
- SSDEEP
  
  1536:83Mz8pr+ehOVEn/g9u1ti/jQWlCsv038L7wlfF:XwoehO0gArukWMsv0+ElfF
Score

10^/10

phorphiex evasion loader persistence trojan worm
- Phorphiex
  Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Windows security bypass

Executes dropped EXE

Windows security modification

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2