phorphiex | 23e57057299c9f8eecb8b7a3972a997445b51b1a2faea9158a4339f41dcb2125

General

Target

2024-06-03_f9393b047db1a8676f810a45e2e9e3da_magniber
Size

5.2MB
Sample

240603-kjld1sae97
MD5

f9393b047db1a8676f810a45e2e9e3da
SHA1

bb31a73b9b85e1464487ae43e6b352f856cf46ba
SHA256

23e57057299c9f8eecb8b7a3972a997445b51b1a2faea9158a4339f41dcb2125
SHA512

004d71c7c12fd0926f864b2779c6c9c8694258f8930660316402a4d0d6b3841cc1e29beb4fa2d36add530403fd3a0439f4415271c869110aa0f4a4c557d52649
SSDEEP

98304:o0vw0mjPoWHVoOzahStaUxFgKkqk3xybC2z+mkOhu:/GPrDvtbgKBCxmfh

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://5.42.96.117/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Attributes

mutex
plo7udsa2s
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Targets

- Target
  
  2024-06-03_f9393b047db1a8676f810a45e2e9e3da_magniber
- Size
  
  5.2MB
- MD5
  
  f9393b047db1a8676f810a45e2e9e3da
- SHA1
  
  bb31a73b9b85e1464487ae43e6b352f856cf46ba
- SHA256
  
  23e57057299c9f8eecb8b7a3972a997445b51b1a2faea9158a4339f41dcb2125
- SHA512
  
  004d71c7c12fd0926f864b2779c6c9c8694258f8930660316402a4d0d6b3841cc1e29beb4fa2d36add530403fd3a0439f4415271c869110aa0f4a4c557d52649
- SSDEEP
  
  98304:o0vw0mjPoWHVoOzahStaUxFgKkqk3xybC2z+mkOhu:/GPrDvtbgKBCxmfh
Score

10^/10

phorphiex xmrig discovery evasion loader miner persistence trojan worm
- Modifies security service
  evasion
- Phorphiex payload
- Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2