phorphiex

General

Target

file.exe
Size

75KB
Sample

230306-sbkrhsch57
MD5

ac85463db28d6aba9a985700614f3c54
SHA1

6878c1e213380942b733b7837e5c00614dea233b
SHA256

eb1e2715a3f8a12c1c8d1d67fb8451172cc8c59390adf942837a006f4bb59f26
SHA512

d5904e4d995dc8689b3e74be1788fb0e84423830edf8e74834af65e726bfdc247f475e26310def409f902949368728f2415a631a2c626951dab5ea6997bd948d
SSDEEP

1536:gW3Mz8byyu11Lc3niGhAX5WKxqlfFZ8eeeeeeeeeeeeeeeeeeeWeeeee:Kwbk1LSiGepvqlfFZ

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0x77BC9dDbaf423139eC0C7F699B676c72Ab34fcc7

TCX5ybBsuZE2BZk6GJMqZaCjBEjiuX1zPP

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Targets

- Target
  
  file.exe
- Size
  
  75KB
- MD5
  
  ac85463db28d6aba9a985700614f3c54
- SHA1
  
  6878c1e213380942b733b7837e5c00614dea233b
- SHA256
  
  eb1e2715a3f8a12c1c8d1d67fb8451172cc8c59390adf942837a006f4bb59f26
- SHA512
  
  d5904e4d995dc8689b3e74be1788fb0e84423830edf8e74834af65e726bfdc247f475e26310def409f902949368728f2415a631a2c626951dab5ea6997bd948d
- SSDEEP
  
  1536:gW3Mz8byyu11Lc3niGhAX5WKxqlfFZ8eeeeeeeeeeeeeeeeeeeWeeeee:Kwbk1LSiGepvqlfFZ
Score

10^/10

phorphiex evasion loader persistence trojan worm
- Phorphiex
  Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Windows security bypass

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2