Overview

overview

10

Static

static

10

8cd916321f...8c.exe

windows7-x64

10

8cd916321f...8c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2d5e7babf1b2d92b56fda0b9044f889a.bin
  • Size 58KB
  • Sample240112-bq65macgh6
  • SHA256 701f8e268aa14d487e3fa1f92e41d89c38f3245c8246e66c2cdd5114367e295d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
phorphiexdiscoveryevasionloaderpersistencetrojanworm

Malware Config

Extracted

Family

  • phorphiex

C2

  • http://185.215.113.93/

  • http://feedmefile.top/

  • http://gotsomefile.top/

  • http://gimmefile.top/

Wallets

  • 15DBeUGFSQLbpYvWLJwzHUXSRrHNU9uQuS8c2wvFLZ7Nxz3N

  • 1E5ZxnNUbbGQarWjMA7tCwp3Btm38GvRkv

  • 3AcMV5pSUcxMmmcMbfSkJXRKbCrF3ysUDJ

  • bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr

  • XkcKjKZqNUkChwJXMj5uDjDns6etXvakir

  • D7MYki8urW3xq8sZJ8Q2v2ZrHxjzp7ACvb

  • 0x76e4CB2fcf7f931Fd750e93F443536Ee068d1cdE

  • LfYFvpk2hccXw12tN3BBMWh7EcUBMbKoTG

  • rUQFcff9R1eKAwTtR1wbuQxmcoB236mz44

  • TEUaG7jyXdyrDS3JeEg1w1hotmmEMjx4TB

  • t1gTRxsrEXwky32j22jgFRZAafBzmCV2M2V

  • AT5Vm3ZrUg98s9kBue2g9YjnwK4kFKhQw3

  • bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr

  • 44L2q3sPJ3DMJZiuSpHvehHMLbMXx3SAoVbLm5DWDw1A7PhUvcCPAGg5qAN98DWAUG7CuD4WmydP4JkewTz2aeVd4qhS822

  • GBLUYL3QTKP3NXVWCYNZ7ZH4CWFT6PVCXEYCNUNSHM34WKG2UL5EDQMV

  • bnb154sx9pdh8er33ujxlpfk3zwvlfp9rd5rskvvgc

  • bc1qn4r93am7rxxr4a5dwydhwx0p2kd4xfd7mz42f3

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36

Targets

    • Target
      8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c.exe
    • Size 112KB
    • SHA256 8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    phorphiexdiscoveryevasionloaderpersistencetrojanworm

    • Phorphiex family

      phorphiex

    • Phorphiex payload

    • Phorphiex, Phorpiex

      Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

      wormtrojanloaderphorphiex

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks