phorphiex | _2012c7af2da6b649bc2bb58f54837b200cafecc44ceda8d5e2e43b0ea205ac97[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_2012c7af2da6b649bc2bb58f54837b200cafecc44ceda8d5e2e43b0ea205ac97.exe
Size 15KB
Sample260706-vrld4adz2k
SHA256 2012c7af2da6b649bc2bb58f54837b200cafecc44ceda8d5e2e43b0ea205ac97
MD5 11ac874e42b051aa5fa54ee1fef48819
SHA1 f6a44ae87468d81226dd5ca366e00cd90bc68e7d
SHA512 fd489fdb4eb78453a3e98e019391debd6e3ffe3a3d7ace48d56a0239fb4667980bc12c80ed512af10e3edff569d47da545cd7bf071ee32326673ada87f7c4b1a
SSDEEP 192:AW/sGnjXgjk8LcRAWIdJDMlIfeF5oIV1BKUSf/zwcd1gJxTmv8U9cthE9ik:AeScqdferoF/Jyav8U9cKX
TLSH
T148623C0BA4818035EBE14474827F526649FEACB623D4F9DBF7E064894AB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm trojan loader phorphiex

Malware Config

Extracted

Family

phorphiex

http://130.12.180.190/xxx/

Mutex

fea3f3f

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

Signatures

Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_2012c7af2da6b649bc2bb58f54837b200cafecc44ceda8d5e2e43b0ea205ac97.exe

File Explorer

_2012c7af2da6b649bc2bb58f54837b200cafecc44ceda8d5e2e43b0ea205ac97.exe

.exe 15KB

_2012c7af2da6b649bc2bb58f54837b200cafecc44ceda8d5e2e43b0ea205ac97.exe

IMPHASH 3537f9c463b968f2d94efe8dfe27133f
SHA256 2012c7af2da6b649bc2bb58f54837b200cafecc44ceda8d5e2e43b0ea205ac97
MD5 11ac874e42b051aa5fa54ee1fef48819
SHA1 f6a44ae87468d81226dd5ca366e00cd90bc68e7d
SHA512 fd489fdb4eb78453a3e98e019391debd6e3ffe3a3d7ace48d56a0239fb4667980bc12c80ed512af10e3edff569d47da545cd7bf071ee32326673ada87f7c4b1a
SSDEEP 192:AW/sGnjXgjk8LcRAWIdJDMlIfeF5oIV1BKUSf/zwcd1gJxTmv8U9cthE9ik:AeScqdferoF/Jyav8U9cKX
TLSH
T148623C0BA4818035EBE14474827F526649FEACB623D4F9DBF7E064894AB46E1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcr90

__dllonexit _lock _onexit _unlock _except_handler4_common _invoke_watson _controlfp_s _crt_debugger_hook ?terminate@@YAXXZ __set_app_type _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln exit _ismbblead _XcptFilter _exit _cexit __getmainargs _amsg_exit mbstowcs atoi _wfopen fgets fclose strtok strchr strcpy memset strstr srand rand sprintf _decode_pointer strlen

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetOpenUrlW InternetOpenW InternetReadFile

shlwapi

StrStrA StrCmpNA PathFileExistsW

ws2_32

recv select htons gethostbyname inet_addr connect socket closesocket setsockopt shutdown WSAStartup send

dnsapi

DnsQuery_A DnsFree

kernel32

GetTickCount lstrlenA GetTimeZoneInformation FileTimeToSystemTime FileTimeToLocalFileTime ExitThread ExitProcess DeleteFileW CreateThread ExpandEnvironmentStringsW GetModuleFileNameW GetLastError CreateMutexA InterlockedExchange InterlockedCompareExchange GetStartupInfoA SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentThreadId Sleep CloseHandle WriteFile CreateFileW GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetLocalTime

user32

wsprintfA wsprintfW