Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    tmp

  • Size

    75KB

  • Sample

    230301-ktygbsfa5x

  • MD5

    19076f70cf529cbcb260befcc4595f1a

  • SHA1

    e24619c6cc207f9ff26ca0ff553901de2e688ca0

  • SHA256

    01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82

  • SHA512

    327d56cb76c2d7e57915189754073f89bec4ae204cd238ed713e885e5e5d1d6b13b4031ea56dcf86a418181ba30b1ae081fc39d0f14902827adcee3d29b54c2f

  • SSDEEP

    1536:gM3Mz8bPS9b1Lc3HiCB+652qRqcfFGWveeeeeeeeeeeeeeeeeeeWeeeee:Ywb01LSCCo0PqcfFG

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0x77BC9dDbaf423139eC0C7F699B676c72Ab34fcc7

TCX5ybBsuZE2BZk6GJMqZaCjBEjiuX1zPP

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Targets

    • Target

      tmp

    • Size

      75KB

    • MD5

      19076f70cf529cbcb260befcc4595f1a

    • SHA1

      e24619c6cc207f9ff26ca0ff553901de2e688ca0

    • SHA256

      01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82

    • SHA512

      327d56cb76c2d7e57915189754073f89bec4ae204cd238ed713e885e5e5d1d6b13b4031ea56dcf86a418181ba30b1ae081fc39d0f14902827adcee3d29b54c2f

    • SSDEEP

      1536:gM3Mz8bPS9b1Lc3HiCB+652qRqcfFGWveeeeeeeeeeeeeeeeeeeWeeeee:Ywb01LSCCo0PqcfFG

    • Phorphiex

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks