Overview

overview

10

Static

static

10

2026-09-05...ry.exe

windows10-2004-x64

10

2026-09-05...ry.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-05_4f9fe8f74cafe157e37c52cf1de87ccf_elex_phorpiex_wannacry
  • Size 37KB
  • Sample260907-26mn2axdke
  • SHA256 50fe25a772910906848ae49942b54289b692ebbb534e099d4e64548bf6e7c351
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
phorphiexdefense_evasiondiscoveryevasionloaderpersistencetrojanworm

Malware Config

Extracted

Family

  • phorphiex

C2

  • http://185.176.27.132/

  • http://urusurofhsorhfuuhk.su/

  • http://aeifaeifhutuhuhusk.su/

  • http://rzhsudhugugfugugsk.su/

  • http://bfagzzezgaegzgfaik.su/

  • http://eaeuafhuaegfugeudk.su/

  • http://aeufuaehfiuehfuhfk.su/

  • http://daedagheauehfuuhfk.su/

  • http://aeoughaoheguaoehdk.su/

  • http://eguaheoghouughahsk.su/

  • http://huaeokaefoaeguaehk.su/

  • http://afaeigaifgsgrhhafk.su/

  • http://afaigaeigieufuifik.su/

  • http://geauhouefheuutiiik.su/

  • http://gaoheeuofhefefhutk.su/

  • http://gaouehaehfoaeajrsk.su/

  • http://gaohrhurhuhruhfsdk.su/

  • http://gaghpaheiafhjefijk.su/

  • http://gaoehuoaoefhuhfugk.su/

  • http://aegohaohuoruitiiek.su/

Wallets

  • 1Bn4JYKoVgQpZ73doWVFSNZBbwKj3cpJNR

  • qqsagteh4m6qunmgrrknulafzcdlmzn35yeggvq8qk

  • Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i

  • D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M

  • 0x05F916216CC4BA6ac89b8093d474E2a1e6121c63

  • LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7

  • t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Targets

    • Target
      2026-09-05_4f9fe8f74cafe157e37c52cf1de87ccf_elex_phorpiex_wannacry
    • Size 37KB
    • SHA256 50fe25a772910906848ae49942b54289b692ebbb534e099d4e64548bf6e7c351
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionphorphiexloaderpersistencetrojanworm

    • Family: Phorphiex, Phorpiex

      Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

      wormtrojanloaderphorphiex

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Phorphiex payload

    • Windows security bypass

      defense_evasiontrojan

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

    • Executes dropped EXE

    • Windows security modification

      defense_evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks