phorphiex

General

Target

a21c6fb746c2eb524c86361adc2d580e.exe
Size

77KB
Sample

230130-pznarsca7w
MD5

a21c6fb746c2eb524c86361adc2d580e
SHA1

b4011c7af9fe49fd2ba69264cd812fbf7472b27c
SHA256

c57a898f765280e3f0ad6d6fa944c6e2c19838e9cf4389be1782c0a86706b849
SHA512

6cd026c4452230fb4cc8357bfd66afaeffc65b4505d0b52ccda62e369dc4cfed54097949959fa469a29db951bea88976e99fe49ce5571f7a4760fe905511295d
SSDEEP

1536:gp3Mz8cRSqgcP53FGFdaNmnQ4EEi+HfFyeeeeeeeeeeeeeeeeeeeWeeeee:VwVM16QdV2fF

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

1Gpu5QiBqsquu71AGqHwb4Y68iwnkdGH1k

3PPJU1omRSTwxDbbfVyxh9Mm8WkiMGZviMh

37AcEVDyoPyUJUKNM3mM1UxNNvKgN6Abn5

qqlt9zzv020vtlswk5v6e90nv7hsuqz0nggp4rj5t0

Xj6orHUgmtZtPb2wGSTX2reQZJ89ZeeYYG

DRyZQqRX998DYdf7zGdTCShGcRBbxjUAbF

0x25229D09B0048F23e60c010C8eE1ae65C727e973

LhoapQ1TFjG2Fvbwn5WbM2wYcwisKRVz7x

r3j2xjQLmVa6Cg3cHZLqLNVja1x6g1AtNL

TVTrpva4J2g8SENebPar4YnfnCqwUeiX4a

t1MrdY4n3DBL3uip5Pq6tqx4doYpihJJG68

AXUqtUXyQmU8buqL5ehCLuLLHhhFrREXuw

bitcoincash:qqlt9zzv020vtlswk5v6e90nv7hsuqz0nggp4rj5t0

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

GDX4NDGHA5WKQLOI65PKPZRHSN6ZAUBRHA7BL44O5IOVMMZFZISMHTUD

bnb1zm5y3pns0ertprnvdyulz63tenlp9kc4m78v0m

bc1qdk0fquc7ug2zn7zpdyx4kasdy34t00c5r2xdup

Targets

- Target
  
  a21c6fb746c2eb524c86361adc2d580e.exe
- Size
  
  77KB
- MD5
  
  a21c6fb746c2eb524c86361adc2d580e
- SHA1
  
  b4011c7af9fe49fd2ba69264cd812fbf7472b27c
- SHA256
  
  c57a898f765280e3f0ad6d6fa944c6e2c19838e9cf4389be1782c0a86706b849
- SHA512
  
  6cd026c4452230fb4cc8357bfd66afaeffc65b4505d0b52ccda62e369dc4cfed54097949959fa469a29db951bea88976e99fe49ce5571f7a4760fe905511295d
- SSDEEP
  
  1536:gp3Mz8cRSqgcP53FGFdaNmnQ4EEi+HfFyeeeeeeeeeeeeeeeeeeeWeeeee:VwVM16QdV2fF
Score

10^/10

phorphiex evasion loader persistence trojan worm
- Phorphiex
  Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Windows security bypass

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2