phorphiex

General

Target

764621435395609860a78ef6d107832fb9bb7f41f02c0bf11a180d9309c008aa
Size

35KB
Sample

221224-2b8m1sag45
MD5

3b43c7af27e511a96e56d0db7c7ff21e
SHA1

9774aebefc0401ea000324203c123758bf97397a
SHA256

67f52b17361f150be6b779be95e707bf73871c9b90462f2307cc3b41277c4fb4
SHA512

7cc6d3e2e0b4b95bb3f083096502d5c6aaa58a20d8b61ed1f2be0f2576f8034444f5a6c0285b7fed1051a9d029db6f6cb422b5bf3bed3bdb5e6b73e9343c4c91
SSDEEP

768:FVnetQ2+JTrD6T/SXyIOYYfj7teMi/x71qOE2:/netQ2eCSXyIO/fj7ud1qO1

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Targets

- Target
  
  764621435395609860a78ef6d107832fb9bb7f41f02c0bf11a180d9309c008aa
- Size
  
  73KB
- MD5
  
  f9f4cefab2c0c41ba4ccce896aaa9e54
- SHA1
  
  3b18b09842ea1b4288def6d7416287d222967297
- SHA256
  
  764621435395609860a78ef6d107832fb9bb7f41f02c0bf11a180d9309c008aa
- SHA512
  
  e7ada22ce6127e4a660d11b78e90f9a94c75aa820ac6b73f3e4f64d65b076e58aea0afb0c3418eb3c6fa5754f0a9840cb1c2dd8069235544eec531a2dabe7cf3
- SSDEEP
  
  1536:83Mz8pr+ehOVEn/g9u1ti/jQWlCsv038L7wlfF:XwoehO0gArukWMsv0+ElfF
Score

10^/10

phorphiex evasion loader persistence trojan worm
- Phorphiex
  Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Windows security bypass

Executes dropped EXE

Windows security modification

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2