phorphiex

General

Target

file.exe
Size

11KB
Sample

230215-scqzxscb2s
MD5

a86bbe655021fd2f6263011c02a0070d
SHA1

597fb8aafd9d1d0ab221c6d8291246f43c9ade7e
SHA256

a1650255f850fabb19b9b75865cef9bd45d89a48390f585f3587da14b7484908
SHA512

93684ebfe4f44a12b6c7f3b41ff05e6a65eec6d8c09418fe51334cb28f9d71f17577f95912b937754896823e4a16b3668e5c04729a82f5c6081a7fc4bdb654ff
SSDEEP

96:S5fKGbUuMszosDmzzGNaU9UGkQaHzVI3b+VIZPtboynuYUi82Ct4Le:4ZX1FYG+jiTZP1oynfUi8xSe

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

1Gpu5QiBqsquu71AGqHwb4Y68iwnkdGH1k

3PPJU1omRSTwxDbbfVyxh9Mm8WkiMGZviMh

37AcEVDyoPyUJUKNM3mM1UxNNvKgN6Abn5

qqlt9zzv020vtlswk5v6e90nv7hsuqz0nggp4rj5t0

Xj6orHUgmtZtPb2wGSTX2reQZJ89ZeeYYG

DRyZQqRX998DYdf7zGdTCShGcRBbxjUAbF

0x25229D09B0048F23e60c010C8eE1ae65C727e973

LhoapQ1TFjG2Fvbwn5WbM2wYcwisKRVz7x

r3j2xjQLmVa6Cg3cHZLqLNVja1x6g1AtNL

TVTrpva4J2g8SENebPar4YnfnCqwUeiX4a

t1MrdY4n3DBL3uip5Pq6tqx4doYpihJJG68

AXUqtUXyQmU8buqL5ehCLuLLHhhFrREXuw

bitcoincash:qqlt9zzv020vtlswk5v6e90nv7hsuqz0nggp4rj5t0

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

GDX4NDGHA5WKQLOI65PKPZRHSN6ZAUBRHA7BL44O5IOVMMZFZISMHTUD

bnb1zm5y3pns0ertprnvdyulz63tenlp9kc4m78v0m

bc1qdk0fquc7ug2zn7zpdyx4kasdy34t00c5r2xdup

Targets

- Target
  
  file.exe
- Size
  
  11KB
- MD5
  
  a86bbe655021fd2f6263011c02a0070d
- SHA1
  
  597fb8aafd9d1d0ab221c6d8291246f43c9ade7e
- SHA256
  
  a1650255f850fabb19b9b75865cef9bd45d89a48390f585f3587da14b7484908
- SHA512
  
  93684ebfe4f44a12b6c7f3b41ff05e6a65eec6d8c09418fe51334cb28f9d71f17577f95912b937754896823e4a16b3668e5c04729a82f5c6081a7fc4bdb654ff
- SSDEEP
  
  96:S5fKGbUuMszosDmzzGNaU9UGkQaHzVI3b+VIZPtboynuYUi82Ct4Le:4ZX1FYG+jiTZP1oynfUi8xSe
Score

10^/10

phorphiex evasion loader persistence trojan worm
- Phorphiex
  Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  evasion trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Windows security bypass

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2