phorphiex | 7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858

General

Target

97fdb440587ae6f237203b2e0338a550_JaffaCakes118
Size

77KB
Sample

240605-nghrwsea2v
MD5

97fdb440587ae6f237203b2e0338a550
SHA1

a8613ac0c99ea6d5073d7474b278794b50f30b24
SHA256

7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858
SHA512

e9e339b95128af836f286fbce08f92ee20f492f4d669c1194c8eecaf86b62a9740301714a20c05a70c0b1d8b31119bff120e2146b19906183706783bee0633aa
SSDEEP

768:Nl92s8vjKGxEFVz7PP/UBV7VWzFYIH4Q:bsswjK3Vz7PPXzFLY

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://worm.ws/

http://feuhdeuhduhuehdr.ws/

http://feauhueudughuurr.ws/

http://fheuhdwdzwgzdggr.ws/

http://faugzeazdezgzgfr.ws/

http://wduufbaueeubffgr.ws/

http://okdoekeoehghaoer.ws/

http://efuheruhdehduhgr.ws/

http://eafueudzefverrgr.ws/

http://deauduafzgezzfgr.ws/

http://gaueudbuwdbuguur.ws/

http://efeuafubeubaefur.ws/

http://eafuebdbedbedggr.ws/

http://wdkowdohwodhfhfr.ws/

http://efaeduvedvzfufur.ws/

http://edhuaudhuedugufr.ws/

http://eaffuebudbeudbbr.ws/

http://seuufhehfueughel.to/

http://feuhdeuhduhuehdl.to/

http://feauhueudughuurl.to/

Wallets

19KXPyopGnfZ1dGjLpPPqbo7Jpqki9A9mW

3NShfYPbqkPmPkXEgJ1SGUYgSjxt1Robhs

bc1qf4awd7k76q0tks25ax7q48wmsvslvy64er6n6w

qqe5entlms8sudv7a60dnu5gpttlukmspuk5zxsahe

XjgwEqD6iFf5pHxqSzj4tm8mgs7TsS2kEw

DHvsojZJPxoYYwtVw7voSuv2ga5LGoQpG1

0xA557fe5c21325eB8f6C7d5f2004Db988c8C8D8B5

LYr5qEmeAcpv7JeCEE2HfGPV74DZLYHeT2

42TCgxVg6itTv4v8dvyCQEETmHL5N6i8a8rvcqGWb2QtWUrBpq3SdDnZbhpcg2S3UbNG98Woi6KEH7dWtpnEHQrDEzQbENy

rDs45wyGR5E6sHajNGHeNqvjvXaCJrJ22j

TY59jfEA2xQBk4R8AAJG3tBGQybMm1aSba

t1NBaHW8QgULABaASvzNALmxem8EutnxLtr

GDR62FPKRATKXTLSR3JDCVGDAVF6YC5RVZ2RQ55SNW6C2UWND3KGUHPW

P44ZCLTNESUGZESVC3QMK6LSFY7LYW3N23FKX56UMCEXK6NZBG3BUNPDWI

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36

Targets

- Target
  
  97fdb440587ae6f237203b2e0338a550_JaffaCakes118
- Size
  
  77KB
- MD5
  
  97fdb440587ae6f237203b2e0338a550
- SHA1
  
  a8613ac0c99ea6d5073d7474b278794b50f30b24
- SHA256
  
  7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858
- SHA512
  
  e9e339b95128af836f286fbce08f92ee20f492f4d669c1194c8eecaf86b62a9740301714a20c05a70c0b1d8b31119bff120e2146b19906183706783bee0633aa
- SSDEEP
  
  768:Nl92s8vjKGxEFVz7PP/UBV7VWzFYIH4Q:bsswjK3Vz7PPXzFLY
Score

10^/10

phorphiex evasion loader persistence trojan worm
- Phorphiex payload
- Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2