Overview

overview

10

Static

static

3

f4909c420e...66.exe

windows7-x64

10

f4909c420e...66.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066

  • Size

    215KB

  • Sample

    241113-feg4kswera

  • MD5

    ab97f71125a89d4d3d0855b8a419d3e1

  • SHA1

    2442d4a7cfbe7fd22708034c853faf9aa4337907

  • SHA256

    f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066

  • SHA512

    5abcab63f953a04d4c4a0eeb38f1716003fdecd2a8b465687e39f5bd492efe587bff06fedcc0724246f59a0b1e799765a6e49169b17728960c2cb066236f6038

  • SSDEEP

    3072:krVZV7IFJc/+mKda7FpoXaoxRypPzB1DuFYJPrbLxYpj5S3BugoIvc/:krNEFJndso2vD3RrbLxYpj5gRy

Score
10/10
phorphiexdiscoveryevasionloaderpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.176.27.132/

http://urusurofhsorhfuuhp.su/

http://aeifaeifhutuhuhusp.su/

http://rzhsudhugugfugugsp.su/

http://bfagzzezgaegzgfaip.su/

http://eaeuafhuaegfugeudp.su/

http://aeufuaehfiuehfuhfp.su/

http://daedagheauehfuuhfp.su/

http://aeoughaoheguaoehdp.su/

http://eguaheoghouughahsp.su/

http://huaeokaefoaeguaehp.su/

http://afaeigaifgsgrhhafp.su/

http://afaigaeigieufuifip.su/

http://geauhouefheuutiiip.su/

http://gaoheeuofhefefhutp.su/

http://gaouehaehfoaeajrsp.su/

http://gaohrhurhuhruhfsdp.su/

http://gaghpaheiafhjefijp.su/

http://gaoehuoaoefhuhfugp.su/

http://aegohaohuoruitiiep.su/
Wallets

19mduWVW9QphW5W2caWF84wcGVSmASRYpf

qp5d3zpgldngtzf0xg2swnqaedfhn3kmsyhk7kp0yt

Xj2EfZ34QwSskhx4aRjWjGpLpMgNQWgYeV

DRkCr8Qum86fMBT3ceyzYBAGzD8pbRZmba

0xab1b250d67d08bf73ac864ea57af8cf762a29649

LVvqtuuqxcPbmqZ7VQju6kFTmQKZ58yXH2

t1dWznNU9rPvPLhmgUQTivyFYmCk4FhDKRc
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Targets

    • Target

      f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066

    • Size

      215KB

    • MD5

      ab97f71125a89d4d3d0855b8a419d3e1

    • SHA1

      2442d4a7cfbe7fd22708034c853faf9aa4337907

    • SHA256

      f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066

    • SHA512

      5abcab63f953a04d4c4a0eeb38f1716003fdecd2a8b465687e39f5bd492efe587bff06fedcc0724246f59a0b1e799765a6e49169b17728960c2cb066236f6038

    • SSDEEP

      3072:krVZV7IFJc/+mKda7FpoXaoxRypPzB1DuFYJPrbLxYpj5S3BugoIvc/:krNEFJndso2vD3RrbLxYpj5gRy

    Score
    10/10
    phorphiexdiscoveryevasionloaderpersistencetrojanworm

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Phorphiex family

      phorphiex

    • Phorphiex payload

    • Phorphiex, Phorpiex

      Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

      wormtrojanloaderphorphiex

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks