General

  • Target

    0847eccd21c4fb301d08aff4ce1f0680.bin

  • Size

    103KB

  • Sample

    240803-bg1aqascmf

  • MD5

    0847eccd21c4fb301d08aff4ce1f0680

  • SHA1

    33d30d4c71a35ec681a3cc3865e656531f1eb898

  • SHA256

    9a8c3fa3687c2210410fb8b3a3eb17d2280c3903abb5dc8d27612f67f04b0fb2

  • SHA512

    4f35cb5d8ef86110d8c2318cf0f0f5fa22b85e76d6928d4820aca28a92a52a5cdcd66442b0cf9861413a7592c54fc782dcbbe0ab00a8a6d9f9a534f31cf99cf9

  • SSDEEP

    768:c3MuYuJJXY8i5/6YiBwwSuY9tF9U1QFvTUE7LhKq4i0TBMMqzRCh6R1yw2C/94UR:c3Mz8UwvJA79UWv4FCIV0exfFj

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.84/

Wallets

12gcwY6q4pv4DBbEjeQXwbhDBesLDc755VE2kyzzXRtvBvzd

18xjALsLW57DQcXSgvGE8H9iXkXYvPjSWc

3PLk48rqFRT7ZB2GZVHMJE5aiHr5jjBfZcw

39t2ndtRZKxHPHaprbe6kPaws4vs1nWA94

qz9vrpv9h2j5e6fsqwwsh8e9aaumwvql956ynh9rs9

XmgkLqGXu8HGU7tTbbwWvaJYrgvybx3eZE

DSVC6eMqTCpkaMkCVp6Yn2U7FYkU76VhKB

0xd4F8DfD1cDBa76e9ac6b3b31Ef3C6C6c3D1ea1d0

LXz2Jhi73bna54msz2zpsEpRVAh8KbeYRL

rPTusqR9SMoh7QuYfJ3EJF7Ewogp6HVJEt

TCW3T7UyyN3MWqakTPViWVRAL1kGsYyTL6

t1gE3Hz4ivvEAQMWagv5XuUMkUPcnNkuNGB

AUpwoQdnjVynLKhDkNt1TJh6sgduJnxyJy

bitcoincash:qz9vrpv9h2j5e6fsqwwsh8e9aaumwvql956ynh9rs9

46wi3NQz8eWV9HnGGKtpqKFcyGqWvLXsRP9C4oh3FgJ8M11QzmSrWWu6hW2kdredmQDYFjkJNg8t4Lye6vPuRcCsK71DPYr

GAWB6FUMRQBOF4JSVWAH6GO26C24UL5P44G3LDWK46WMFAS2TAZD7EBC

bnb1yzw7m55vrhqmmw2e0xpven8q49u8m63prv3hhz

bc1q4eym03072yk0zahdm9jym28vk0dxwyvs57sr6g

Attributes
  • mutex

    hh3gg3h

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36

Targets

    • Target

      0847eccd21c4fb301d08aff4ce1f0680.bin

    • Size

      103KB

    • MD5

      0847eccd21c4fb301d08aff4ce1f0680

    • SHA1

      33d30d4c71a35ec681a3cc3865e656531f1eb898

    • SHA256

      9a8c3fa3687c2210410fb8b3a3eb17d2280c3903abb5dc8d27612f67f04b0fb2

    • SHA512

      4f35cb5d8ef86110d8c2318cf0f0f5fa22b85e76d6928d4820aca28a92a52a5cdcd66442b0cf9861413a7592c54fc782dcbbe0ab00a8a6d9f9a534f31cf99cf9

    • SSDEEP

      768:c3MuYuJJXY8i5/6YiBwwSuY9tF9U1QFvTUE7LhKq4i0TBMMqzRCh6R1yw2C/94UR:c3Mz8UwvJA79UWv4FCIV0exfFj

    • Phorphiex payload

    • Phorphiex, Phorpiex

      Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    • Windows security bypass

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks