phorphiex

General

Target

6cbe8a25f7a27d7e68e90923468abdd804d7c0e29cf9979544ba43edae400955
Size

534KB
Sample

230208-mp9d5shh2t
MD5

7d61d9862142353bce359f182437f5e0
SHA1

7acf12fc4064ed246987a8014546367cb3ae04ee
SHA256

6cbe8a25f7a27d7e68e90923468abdd804d7c0e29cf9979544ba43edae400955
SHA512

b1ab7312d7e17bf5ff06e8e6bef85aaea43873ebf9732a8518031f4616108148a1e58f6dcec5a5594fa39b9e3e445642a65ee3a8f5294da2295bd462e9574aaa
SSDEEP

12288:WAqkoCtQO4Nai3jk/PElKgyObjdGCzLSFf:WxkoIgNaP+KLOHdGCze

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

1Gpu5QiBqsquu71AGqHwb4Y68iwnkdGH1k

3PPJU1omRSTwxDbbfVyxh9Mm8WkiMGZviMh

37AcEVDyoPyUJUKNM3mM1UxNNvKgN6Abn5

qqlt9zzv020vtlswk5v6e90nv7hsuqz0nggp4rj5t0

Xj6orHUgmtZtPb2wGSTX2reQZJ89ZeeYYG

DRyZQqRX998DYdf7zGdTCShGcRBbxjUAbF

0x25229D09B0048F23e60c010C8eE1ae65C727e973

LhoapQ1TFjG2Fvbwn5WbM2wYcwisKRVz7x

r3j2xjQLmVa6Cg3cHZLqLNVja1x6g1AtNL

TVTrpva4J2g8SENebPar4YnfnCqwUeiX4a

t1MrdY4n3DBL3uip5Pq6tqx4doYpihJJG68

AXUqtUXyQmU8buqL5ehCLuLLHhhFrREXuw

bitcoincash:qqlt9zzv020vtlswk5v6e90nv7hsuqz0nggp4rj5t0

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

GDX4NDGHA5WKQLOI65PKPZRHSN6ZAUBRHA7BL44O5IOVMMZFZISMHTUD

bnb1zm5y3pns0ertprnvdyulz63tenlp9kc4m78v0m

bc1qdk0fquc7ug2zn7zpdyx4kasdy34t00c5r2xdup

Targets

- Target
  
  6cbe8a25f7a27d7e68e90923468abdd804d7c0e29cf9979544ba43edae400955
- Size
  
  534KB
- MD5
  
  7d61d9862142353bce359f182437f5e0
- SHA1
  
  7acf12fc4064ed246987a8014546367cb3ae04ee
- SHA256
  
  6cbe8a25f7a27d7e68e90923468abdd804d7c0e29cf9979544ba43edae400955
- SHA512
  
  b1ab7312d7e17bf5ff06e8e6bef85aaea43873ebf9732a8518031f4616108148a1e58f6dcec5a5594fa39b9e3e445642a65ee3a8f5294da2295bd462e9574aaa
- SSDEEP
  
  12288:WAqkoCtQO4Nai3jk/PElKgyObjdGCzLSFf:WxkoIgNaP+KLOHdGCze
Score

10^/10

phorphiex evasion loader persistence trojan worm
- Phorphiex
  Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  evasion trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Windows security bypass

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2