phorphiex | eb1e2715a3f8a12c1c8d1d67fb8451172cc8c59390adf942837a006f4bb59f26[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
eb1e2715a3f8a12c1c8d1d67fb8451172cc8c59390adf942837a006f4bb59f26.zip
Size 36KB
Sample230308-mlcwrsfa9v
SHA256 5de4bc137fbe8d2dcc0ac208ce5fc026023b7824bb7a65326ea4cc5a7c85324d
MD5 46ee7441c541e032ebef153c5048897b
SHA1 e7bcd4af0a0bbf04d2dd2a4a8adf04d2589c734d
SHA512 54c32938042ee529b04026a7c9226d44aa3570c4520e8d45ef13570036426d2b11a3b5e26ab1a8a8c6af5d330aad7f98dd7474652b5e1909025823dca043339c
SSDEEP 768:auHOopNEe99oXa+7YEYQ5tw43Y0SEyLc3U3bXqM5OHb1z3jiiqQkgcPkWp:auHOocs417aeJJSPLc3IL5OHbpzXHWp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Extracted

Family

phorphiex

http://185.215.113.66/

Wallets

0x77BC9dDbaf423139eC0C7F699B676c72Ab34fcc7
TCX5ybBsuZE2BZk6GJMqZaCjBEjiuX1zPP
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Phorphiex family
phorphiex

File Explorer

eb1e2715a3f8a12c1c8d1d67fb8451172cc8c59390adf942837a006f4bb59f26.zip

.zip 36KB
eb1e2715a3f8a12c1c8d1d67fb8451172cc8c59390adf942837a006f4bb59f26.exe

.exe 75KB

eb1e2715a3f8a12c1c8d1d67fb8451172cc8c59390adf942837a006f4bb59f26.zip

SHA256 5de4bc137fbe8d2dcc0ac208ce5fc026023b7824bb7a65326ea4cc5a7c85324d
MD5 46ee7441c541e032ebef153c5048897b
SHA1 e7bcd4af0a0bbf04d2dd2a4a8adf04d2589c734d
SHA512 54c32938042ee529b04026a7c9226d44aa3570c4520e8d45ef13570036426d2b11a3b5e26ab1a8a8c6af5d330aad7f98dd7474652b5e1909025823dca043339c
SSDEEP 768:auHOopNEe99oXa+7YEYQ5tw43Y0SEyLc3U3bXqM5OHb1z3jiiqQkgcPkWp:auHOocs417aeJJSPLc3IL5OHbpzXHWp
MD5 SHA1 SHA512 SSDEEP

Password

infected

eb1e2715a3f8a12c1c8d1d67fb8451172cc8c59390adf942837a006f4bb59f26.exe

IMPHASH dac8ae7c837e7fe3a3ea62e0b6800155
SHA256 eb1e2715a3f8a12c1c8d1d67fb8451172cc8c59390adf942837a006f4bb59f26
MD5 ac85463db28d6aba9a985700614f3c54
SHA1 6878c1e213380942b733b7837e5c00614dea233b
SHA512 d5904e4d995dc8689b3e74be1788fb0e84423830edf8e74834af65e726bfdc247f475e26310def409f902949368728f2415a631a2c626951dab5ea6997bd948d
SSDEEP 1536:gW3Mz8byyu11Lc3niGhAX5WKxqlfFZ8eeeeeeeeeeeeeeeeeeeWeeeee:Kwbk1LSiGepvqlfFZ
MD5 SHA1 SHA512 SSDEEP

windows x86

Password

infected

Minor OS version

Major OS version

Entry point

23552

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

recvfrom setsockopt sendto send recv ioctlsocket WSAStartup bind WSACloseEvent WSARecv WSASend WSAGetLastError WSAEnumNetworkEvents gethostname connect inet_ntoa inet_addr htons getsockname shutdown socket closesocket gethostbyname WSAEventSelect WSAGetOverlappedResult WSAWaitForMultipleEvents getpeername accept WSACreateEvent WSASocketA listen

shlwapi

PathFileExistsW StrCmpNW PathMatchSpecW PathFindFileNameW StrChrA StrStrIA StrCmpNIA StrStrW

urlmon

URLDownloadToFileW

wininet

HttpOpenRequestA InternetOpenUrlW InternetOpenUrlA HttpQueryInfoA InternetOpenW InternetCloseHandle InternetOpenA HttpSendRequestA InternetConnectA InternetCrackUrlA InternetReadFile HttpAddRequestHeadersA

ntdll

memcpy _chkstk _aulldiv RtlUnwind memmove mbstowcs RtlTimeToSecondsSince1980 NtQuerySystemTime NtQueryVirtualMemory strstr isdigit isalpha _allshl _aullshr memset

msvcrt

rand srand _vscprintf

kernel32

GetLastError CreateProcessW GetLocaleInfoA DuplicateHandle DeleteCriticalSection GetThreadPriority SetThreadPriority GetCurrentThread GetCurrentProcess InterlockedExchangeAdd InterlockedIncrement InterlockedExchange WaitForSingleObject InterlockedDecrement GetCurrentProcessId HeapSetInformation GetSystemInfo PostQueuedCompletionStatus GetProcessHeaps HeapValidate HeapCreate HeapFree HeapAlloc HeapReAlloc ExpandEnvironmentStringsW CreateThread DeleteFileA CreateMutexA MoveFileA MoveFileW CreateEventA GetQueuedCompletionStatus CreateIoCompletionPort SetEvent ExitProcess GetVolumeInformationW SetFileAttributesW lstrcpyW DeleteFileW GetDiskFreeSpaceExW FindNextFileW lstrcmpiW QueryDosDeviceW RemoveDirectoryW lstrlenA GlobalLock GetModuleHandleW GetTickCount GlobalAlloc Sleep lstrcpynW ExitThread MultiByteToWideChar lstrlenW GlobalUnlock GetFileSize MapViewOfFile UnmapViewOfFile WriteFile InitializeCriticalSection LeaveCriticalSection CreateFileW FlushFileBuffers EnterCriticalSection CreateFileMappingW CloseHandle FindFirstFileW GetDriveTypeW MoveFileExW CreateDirectoryW GetLogicalDrives CopyFileW GetModuleFileNameW lstrcmpW FindClose

user32

TranslateMessage RegisterClassExW wsprintfW GetClipboardData EmptyClipboard ChangeClipboardChain SetWindowLongW DefWindowProcA RegisterRawInputDevices CreateWindowExW SendMessageA IsClipboardFormatAvailable CloseClipboard GetMessageA wsprintfA wvsprintfA GetWindowLongW DispatchMessageA OpenClipboard SetClipboardData SetClipboardViewer

advapi32

RegSetValueExW CryptGenRandom CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExA RegSetValueExA RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysFreeString SysAllocString