phorphiex | 99cf61fce5dc1b5ce8080b968b0ffd36a293fb8755e6c1acf56bf4a8ca832b12 | Triage

Resubmissions

04-12-2024 19:46

241204-yg89ysxqhz 10

29-11-2024 18:21

241129-wzbqaszmh1 10

Sharing

General

Target

99cf61fce5dc1b5ce8080b968b0ffd36a293fb8755e6c1acf56bf4a8ca832b12.exe
Size

37KB
Sample

241129-wzbqaszmh1
MD5

e4ab58a21de691f6df0994936619b704
SHA1

b8655320679684d1c28d6180a62f190883fd3527
SHA256

99cf61fce5dc1b5ce8080b968b0ffd36a293fb8755e6c1acf56bf4a8ca832b12
SHA512

297ab8a96a24505f4fa504ecbbf6f3c766a1a53104c979d4a8ce932dbe1340d953301c371e651112b79c2ed85ef235e04f8d7d32d50487e7050e84bdfb148ba7
SSDEEP

768:NRrgLWAzIaRPsGtUHoVTp6OxZ0d01coO269UVv/:PGsapQIVcO729UVv/

Score

10^/10

phorphiex discovery evasion loader trojan worm

Malware Config

Targets

- Target
  
  99cf61fce5dc1b5ce8080b968b0ffd36a293fb8755e6c1acf56bf4a8ca832b12.exe
- Size
  
  37KB
- MD5
  
  e4ab58a21de691f6df0994936619b704
- SHA1
  
  b8655320679684d1c28d6180a62f190883fd3527
- SHA256
  
  99cf61fce5dc1b5ce8080b968b0ffd36a293fb8755e6c1acf56bf4a8ca832b12
- SHA512
  
  297ab8a96a24505f4fa504ecbbf6f3c766a1a53104c979d4a8ce932dbe1340d953301c371e651112b79c2ed85ef235e04f8d7d32d50487e7050e84bdfb148ba7
- SSDEEP
  
  768:NRrgLWAzIaRPsGtUHoVTp6OxZ0d01coO269UVv/:PGsapQIVcO729UVv/
Score

10^/10

phorphiex discovery loader trojan worm evasion
- Modifies firewall policy service
  evasion
- Phorphiex family
  phorphiex
- Phorphiex payload
- Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

phorphiexdiscoveryloadertrojanworm

behavioral2

phorphiexdiscoveryevasionloadertrojanworm