Overview

overview

10

Static

static

3

JaffaCakes...dc.exe

windows7-x64

10

JaffaCakes...dc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_db3c481f3eff1160e337e7971ef1d5dc

  • Size

    404KB

  • Sample

    250110-fbqasavmcr

  • MD5

    db3c481f3eff1160e337e7971ef1d5dc

  • SHA1

    233bca64d79acfabeeffeb028d8b0a011be38de2

  • SHA256

    ae73ef74543ce177e7d376df37c9d497df69bdb3777a5e3efa5cc43205321414

  • SHA512

    9754726b363c4ea7df6a7226f24357f1b82b727c159d6b58c902dc5fab53896aeca728a91795a7bede94ac1df22e4d90dbde5fdfe3cd27d94b4119ee7e0bff72

  • SSDEEP

    6144:u9qlSqfb+6C82rv7pQsvKC1j7BQRyDo5Sv307a05LiSzt:u9qRfb+6C8A7p/z6ygEd05LiEt

Score
10/10
phorphiexdiscoveryevasionloaderpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.176.27.132/

http://urusurofhsorhfuuhk.su/

http://aeifaeifhutuhuhusk.su/

http://rzhsudhugugfugugsk.su/

http://bfagzzezgaegzgfaik.su/

http://eaeuafhuaegfugeudk.su/

http://aeufuaehfiuehfuhfk.su/

http://daedagheauehfuuhfk.su/

http://aeoughaoheguaoehdk.su/

http://eguaheoghouughahsk.su/

http://huaeokaefoaeguaehk.su/

http://afaeigaifgsgrhhafk.su/

http://afaigaeigieufuifik.su/

http://geauhouefheuutiiik.su/

http://gaoheeuofhefefhutk.su/

http://gaouehaehfoaeajrsk.su/

http://gaohrhurhuhruhfsdk.su/

http://gaghpaheiafhjefijk.su/

http://gaoehuoaoefhuhfugk.su/

http://aegohaohuoruitiiek.su/
Wallets

1Bn4JYKoVgQpZ73doWVFSNZBbwKj3cpJNR

qqsagteh4m6qunmgrrknulafzcdlmzn35yeggvq8qk

Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i

D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M

0x05F916216CC4BA6ac89b8093d474E2a1e6121c63

LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7

t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Targets

    • Target

      JaffaCakes118_db3c481f3eff1160e337e7971ef1d5dc

    • Size

      404KB

    • MD5

      db3c481f3eff1160e337e7971ef1d5dc

    • SHA1

      233bca64d79acfabeeffeb028d8b0a011be38de2

    • SHA256

      ae73ef74543ce177e7d376df37c9d497df69bdb3777a5e3efa5cc43205321414

    • SHA512

      9754726b363c4ea7df6a7226f24357f1b82b727c159d6b58c902dc5fab53896aeca728a91795a7bede94ac1df22e4d90dbde5fdfe3cd27d94b4119ee7e0bff72

    • SSDEEP

      6144:u9qlSqfb+6C82rv7pQsvKC1j7BQRyDo5Sv307a05LiSzt:u9qRfb+6C8A7p/z6ygEd05LiEt

    Score
    10/10
    phorphiexdiscoveryevasionloaderpersistencetrojanworm

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Phorphiex family

      phorphiex

    • Phorphiex payload

    • Phorphiex, Phorpiex

      Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

      wormtrojanloaderphorphiex

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks