General

  • Target

    629fba91ff579f1e890e489a028d7eb1_JaffaCakes118

  • Size

    32KB

  • Sample

    240521-j5vzxaeb73

  • MD5

    629fba91ff579f1e890e489a028d7eb1

  • SHA1

    c6871d6ce30d012e79412761bd6c0c75be37d084

  • SHA256

    6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

  • SHA512

    5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183

  • SSDEEP

    384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz

Malware Config

Extracted

Family

phorphiex

C2

http://worm.ws/

http://seuufhehfueugheh.ws/

http://feuhdeuhduhuehdh.ws/

http://feauhueudughuurh.ws/

http://fheuhdwdzwgzdggh.ws/

http://faugzeazdezgzgfh.ws/

http://wduufbaueeubffgh.ws/

http://okdoekeoehghaoeh.ws/

http://efuheruhdehduhgh.ws/

http://eafueudzefverrgh.ws/

http://deauduafzgezzfgh.ws/

http://gaueudbuwdbuguuh.ws/

http://efeuafubeubaefuh.ws/

http://eafuebdbedbedggh.ws/

http://wdkowdohwodhfhfh.ws/

http://efaeduvedvzfufuh.ws/

http://edhuaudhuedugufh.ws/

http://eaffuebudbeudbbh.ws/

http://seuufhehfueughet.to/

http://feuhdeuhduhuehdt.to/

Wallets

19KXPyopGnfZ1dGjLpPPqbo7Jpqki9A9mW

3NShfYPbqkPmPkXEgJ1SGUYgSjxt1Robhs

bc1qf4awd7k76q0tks25ax7q48wmsvslvy64er6n6w

qqe5entlms8sudv7a60dnu5gpttlukmspuk5zxsahe

XjgwEqD6iFf5pHxqSzj4tm8mgs7TsS2kEw

DHvsojZJPxoYYwtVw7voSuv2ga5LGoQpG1

0xA557fe5c21325eB8f6C7d5f2004Db988c8C8D8B5

LYr5qEmeAcpv7JeCEE2HfGPV74DZLYHeT2

42TCgxVg6itTv4v8dvyCQEETmHL5N6i8a8rvcqGWb2QtWUrBpq3SdDnZbhpcg2S3UbNG98Woi6KEH7dWtpnEHQrDEzQbENy

rDs45wyGR5E6sHajNGHeNqvjvXaCJrJ22j

TY59jfEA2xQBk4R8AAJG3tBGQybMm1aSba

t1NBaHW8QgULABaASvzNALmxem8EutnxLtr

GDR62FPKRATKXTLSR3JDCVGDAVF6YC5RVZ2RQ55SNW6C2UWND3KGUHPW

P44ZCLTNESUGZESVC3QMK6LSFY7LYW3N23FKX56UMCEXK6NZBG3BUNPDWI

Targets

    • Target

      629fba91ff579f1e890e489a028d7eb1_JaffaCakes118

    • Size

      32KB

    • MD5

      629fba91ff579f1e890e489a028d7eb1

    • SHA1

      c6871d6ce30d012e79412761bd6c0c75be37d084

    • SHA256

      6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

    • SHA512

      5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183

    • SSDEEP

      384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz

    • Phorphiex

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    • Phorphiex payload

    • Windows security bypass

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks