phorphiex | 061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3

General

Target

061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe
Size

113KB
Sample

240702-yacx6szdlj
MD5

d54208c1d2a0c3475398fc2ee70f3e40
SHA1

0d17b29fe85194032ebae3fc1e7b8d614ffb20f4
SHA256

061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3
SHA512

2bd65b0c6a23727d281ec7e79f16ce48609015c63c4529546543f9221d4dcc0907dfb9e1c6fb42134bc6ee87d709f83a4a3bf36881569153c59641bb2cd4d7cc
SSDEEP

3072:TwoehO0gArukWMsv0+ElfFtewoehO0gArukWO:0xhO+rj+OtFtVxhO+rX

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

Attributes

mutex
5858874
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36

Targets

- Target
  
  061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe
- Size
  
  113KB
- MD5
  
  d54208c1d2a0c3475398fc2ee70f3e40
- SHA1
  
  0d17b29fe85194032ebae3fc1e7b8d614ffb20f4
- SHA256
  
  061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3
- SHA512
  
  2bd65b0c6a23727d281ec7e79f16ce48609015c63c4529546543f9221d4dcc0907dfb9e1c6fb42134bc6ee87d709f83a4a3bf36881569153c59641bb2cd4d7cc
- SSDEEP
  
  3072:TwoehO0gArukWMsv0+ElfFtewoehO0gArukWO:0xhO+rj+OtFtVxhO+rX
Score

10^/10

phorphiex evasion loader persistence trojan worm spyware stealer
- Phorphiex payload
- Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Windows security bypass
  evasion trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Phorphiex payload

Phorphiex, Phorpiex

Windows security bypass

Downloads MZ/PE file

Executes dropped EXE

Reads user/profile data of web browsers

Windows security modification

Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2