phorphiex | e0ac83cca269a5a55209fe32a48f82f5b670b9a4f8122520345f849ed1cd5a37 | Triage

Sharing

General

Target

e0ac83cca269a5a55209fe32a48f82f5b670b9a4f8122520345f849ed1cd5a37
Size

76KB
Sample

250209-hf8n2ayley
MD5

a02b0359de0597cb75c86eeb5b0bd00d
SHA1

520011c185dff47791e09d0d11ad0bb9b7dec9d3
SHA256

e0ac83cca269a5a55209fe32a48f82f5b670b9a4f8122520345f849ed1cd5a37
SHA512

9d910f9f2a308badac23cdacfae2057529499b56de832fce7e83e8960e38055d2676be2269ad0f6e3b72c9aded29548e59fae39c1021609f1451edcd0c8ebf7c
SSDEEP

1536:03Mz8GuoohIUXrtvWhzNmgrZBVnWw7V15FvVn:vwGu/XpOh5mgrVnj7V15FvV

Score

10^/10

phorphiex defense_evasion discovery loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.84/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Attributes

mutex
3fk04gs
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36

Targets

- Target
  
  e0ac83cca269a5a55209fe32a48f82f5b670b9a4f8122520345f849ed1cd5a37
- Size
  
  76KB
- MD5
  
  a02b0359de0597cb75c86eeb5b0bd00d
- SHA1
  
  520011c185dff47791e09d0d11ad0bb9b7dec9d3
- SHA256
  
  e0ac83cca269a5a55209fe32a48f82f5b670b9a4f8122520345f849ed1cd5a37
- SHA512
  
  9d910f9f2a308badac23cdacfae2057529499b56de832fce7e83e8960e38055d2676be2269ad0f6e3b72c9aded29548e59fae39c1021609f1451edcd0c8ebf7c
- SSDEEP
  
  1536:03Mz8GuoohIUXrtvWhzNmgrZBVnWw7V15FvVn:vwGu/XpOh5mgrVnj7V15FvV
Score

10^/10

phorphiex defense_evasion discovery loader persistence trojan worm
- Phorphiex family
  phorphiex
- Phorphiex payload
- Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  defense_evasion trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

phorphiexdefense_evasiondiscoveryloaderpersistencetrojanworm

behavioral2

phorphiexdefense_evasiondiscoveryloaderpersistencetrojanworm