General

  • Target

    2024-12-01_1990c5c7fb271c3642fffcc718332a66_hijackloader_luca-stealer_magniber

  • Size

    6.7MB

  • Sample

    241201-g4wtpsspem

  • MD5

    1990c5c7fb271c3642fffcc718332a66

  • SHA1

    96772cec65af281b67ba770838b354f02fc4acaf

  • SHA256

    e5506f1442e9d76f61dff5b158caa4cbbe942cd9e27dc378d31eefce4d11c59c

  • SHA512

    ebf369d5450ac352fe2d21b2ba58acde3e0c3572354d5aee7176289be255278cb3ef0808da4d21443ad80165b19480642e3539a1b7ffc039c5a61d609ef6adf3

  • SSDEEP

    98304:q0vhWhkxBW2oqIht3aMQPfb6Fw04X1xEg+CNlPSHtzQLy9rF:ZKkxBW/qgkvFX1xEyP8zQG9r

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd

Attributes
  • mutex

    753f85d83d

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

phorphiex

C2

http://185.215.113.84

Targets

    • Target

      2024-12-01_1990c5c7fb271c3642fffcc718332a66_hijackloader_luca-stealer_magniber

    • Size

      6.7MB

    • MD5

      1990c5c7fb271c3642fffcc718332a66

    • SHA1

      96772cec65af281b67ba770838b354f02fc4acaf

    • SHA256

      e5506f1442e9d76f61dff5b158caa4cbbe942cd9e27dc378d31eefce4d11c59c

    • SHA512

      ebf369d5450ac352fe2d21b2ba58acde3e0c3572354d5aee7176289be255278cb3ef0808da4d21443ad80165b19480642e3539a1b7ffc039c5a61d609ef6adf3

    • SSDEEP

      98304:q0vhWhkxBW2oqIht3aMQPfb6Fw04X1xEg+CNlPSHtzQLy9rF:ZKkxBW/qgkvFX1xEyP8zQG9r

    • Phorphiex family

    • Phorphiex payload

    • Phorphiex, Phorpiex

      Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.