General
-
Target
2025-05-20_e99a7fc4f4165bf30bd58901b0e675bf_amadey_black-basta_elex_hijackloader_luca-stealer
-
Size
629KB
-
Sample
250520-2fkfzsdk6v
-
MD5
e99a7fc4f4165bf30bd58901b0e675bf
-
SHA1
ede28ff2015c281c06284da57d79727e79fe53b4
-
SHA256
da6d24a41f8b7eefb06f2b81dac35fc207dfd91e14feb154124dd62e316ea215
-
SHA512
22394182e478a27cf9da3470e8e091815c7b50cfd17feebf79b9e22d8e30256fa2d5c9da614e956efbc54433a9cfcd556f223b5432ce345742ec158cd989939c
-
SSDEEP
12288:SC229hzKjhvz9BbdWyaSrvu7yWXChDnlNstIlpLM4wfK0i:U29xKjhvz9BhW9g2yjhDnXstQpcKr
Static task
static1
Malware Config
Extracted
phorphiex
http://185.156.72.39
185.156.72.39
Extracted
phorphiex
http://185.156.72.39/
http://45.141.233.6/
TW3wpRJmZgC5WifuY468JBUCF3TEkzBT5H
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MF6iVGLmErYP9y4B9SwtzarDoy3ETSzYrh
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
0x46e5cc402BC848ceC9f4d65c9B48aE7D7A24821B
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1B8FF5WwJXNnjkVzxgPkAznVZ8uKb3Watx
ltc1qyfzdpxky7q2grz4zmqv5x0t0uwfuznl5u43c93
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3GcQJkfHq7NWgBhhNKjz7uSfM6LzADpLvX
CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1q9tgkga69k094n5v0pn7ewmpp2kn66sh9hu65gq
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
l9n7b5f2r
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Targets
-
-
Target
2025-05-20_e99a7fc4f4165bf30bd58901b0e675bf_amadey_black-basta_elex_hijackloader_luca-stealer
-
Size
629KB
-
MD5
e99a7fc4f4165bf30bd58901b0e675bf
-
SHA1
ede28ff2015c281c06284da57d79727e79fe53b4
-
SHA256
da6d24a41f8b7eefb06f2b81dac35fc207dfd91e14feb154124dd62e316ea215
-
SHA512
22394182e478a27cf9da3470e8e091815c7b50cfd17feebf79b9e22d8e30256fa2d5c9da614e956efbc54433a9cfcd556f223b5432ce345742ec158cd989939c
-
SSDEEP
12288:SC229hzKjhvz9BbdWyaSrvu7yWXChDnlNstIlpLM4wfK0i:U29xKjhvz9BhW9g2yjhDnXstQpcKr
-
Phorphiex family
-
Phorphiex payload
-
Xmrig family
-
XMRig Miner payload
-
Creates new service(s)
-
Downloads MZ/PE file
-
Stops running service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
1Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1