phorphiex

General

Target

file
Size

74KB
Sample

230125-ph79lsfh99
MD5

de4ef0426636519491bba15a7a6cda05
SHA1

d15a7fa38bf5015a8838bd37f4bcfb8aa86dc4a4
SHA256

62657e8757de34719b452195502d0c76f960f2eb566e725bbd1f6772d14bde74
SHA512

f99d24f60091997d2335f29400a928818eb54a756dc6faa269e93909e1ceac64a0db0ab61cadfe946280390dfaf9b5ea63c1c95942cb703a1278fa9957067116
SSDEEP

1536:ga3Mz8OpJS7LcTolIk4Fvxv8xRh9sfFF:6wb7LeaIkQvxvqGfFF

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

1Gpu5QiBqsquu71AGqHwb4Y68iwnkdGH1k

3PPJU1omRSTwxDbbfVyxh9Mm8WkiMGZviMh

37AcEVDyoPyUJUKNM3mM1UxNNvKgN6Abn5

qqlt9zzv020vtlswk5v6e90nv7hsuqz0nggp4rj5t0

Xj6orHUgmtZtPb2wGSTX2reQZJ89ZeeYYG

DRyZQqRX998DYdf7zGdTCShGcRBbxjUAbF

0x25229D09B0048F23e60c010C8eE1ae65C727e973

LhoapQ1TFjG2Fvbwn5WbM2wYcwisKRVz7x

r3j2xjQLmVa6Cg3cHZLqLNVja1x6g1AtNL

TVTrpva4J2g8SENebPar4YnfnCqwUeiX4a

t1MrdY4n3DBL3uip5Pq6tqx4doYpihJJG68

AXUqtUXyQmU8buqL5ehCLuLLHhhFrREXuw

bitcoincash:qqlt9zzv020vtlswk5v6e90nv7hsuqz0nggp4rj5t0

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

GDX4NDGHA5WKQLOI65PKPZRHSN6ZAUBRHA7BL44O5IOVMMZFZISMHTUD

bnb1zm5y3pns0ertprnvdyulz63tenlp9kc4m78v0m

bc1qdk0fquc7ug2zn7zpdyx4kasdy34t00c5r2xdup

Targets

- Target
  
  file
- Size
  
  74KB
- MD5
  
  de4ef0426636519491bba15a7a6cda05
- SHA1
  
  d15a7fa38bf5015a8838bd37f4bcfb8aa86dc4a4
- SHA256
  
  62657e8757de34719b452195502d0c76f960f2eb566e725bbd1f6772d14bde74
- SHA512
  
  f99d24f60091997d2335f29400a928818eb54a756dc6faa269e93909e1ceac64a0db0ab61cadfe946280390dfaf9b5ea63c1c95942cb703a1278fa9957067116
- SSDEEP
  
  1536:ga3Mz8OpJS7LcTolIk4Fvxv8xRh9sfFF:6wb7LeaIkQvxvqGfFF
Score

10^/10

phorphiex evasion loader persistence trojan worm xmrig miner upx
- Phorphiex
  Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

xmrig

XMRig Miner payload

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Loads dropped DLL

Windows security modification

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2