MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Phorpiex


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
SHA3-384 hash: 3c8d20920f7cfe95fdc66a6c7fed30cf629e0330fd7995f04a2d24b5c2ecdd71dfec37f408327dc484cfd40d89ece89f
SHA1 hash: e24619c6cc207f9ff26ca0ff553901de2e688ca0
MD5 hash: 19076f70cf529cbcb260befcc4595f1a
humanhash: uniform-oxygen-hamper-december
File name:19076f70cf529cbcb260befcc4595f1a.exe
Download: download sample
Signature Phorpiex
Create hunting rule
File size:76'800 bytes
First seen:2023-02-27 16:27:31 UTC
Last seen:2023-02-27 18:30:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash dac8ae7c837e7fe3a3ea62e0b6800155 (8 x Phorpiex, 2 x CoinMiner, 1 x CoinMiner.XMRig)
ssdeep 1536:gM3Mz8bPS9b1Lc3HiCB+652qRqcfFGWveeeeeeeeeeeeeeeeeeeWeeeee:Ywb01LSCCo0PqcfFG
Threatray 39 similar samples on MalwareBazaar
TLSH T194732810F6D0C136F0F780FFD2FB05AA592CAFB4530698E752D5A89F9B245D1A932463
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter abuse_ch
Tags:exe Phorpiex

Intelligence

File Origin
# of uploads :
2
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
10fd468787410c84536b1626887bf74c.exe
Verdict:
Malicious activity
Analysis date:
2023-02-27 11:38:41 UTC
Tags:
loader
Link:
https://app.any.run/tasks/314648fb-6f77-4f08-98ed-c291221aabfd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/370338/
Detection(s):
SecuriteInfo.com.Trojan.FWDisable.emW@ayGhlE.129.28686.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
83%
Tags:
greyware shell32.dll
Link:
https://www.filescan.io/uploads/63fcda145d47c2515e80a24f/reports/705199a2-b6a9-4b4b-b88a-1ff87165cc05/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d361d467-efa8-4965-87e7-6040106ba754
Result
Threat name:
Phorpiex, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1183379
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to check if Internet connection is working
Contains functionality to detect sleep reduction / modifications
Detected Stratum mining protocol
Drops executables to the windows directory (C:\Windows) and starts them
Found evasive API chain (may stop execution after checking mutex)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Phorpiex
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 816214 Sample: eZvOzNlUAa.exe Startdate: 27/02/2023 Architecture: WINDOWS Score: 100 94 Snort IDS alert for network traffic 2->94 96 Multi AV Scanner detection for domain / URL 2->96 98 Antivirus detection for URL or domain 2->98 100 10 other signatures 2->100 8 eZvOzNlUAa.exe 1 1 2->8         started        12 winsvrupd.exe 2->12         started        14 powershell.exe 35 2->14         started        16 4 other processes 2->16 process3 file4 66 C:\Windows\sysmsrvcx.exe, PE32 8->66 dropped 126 Antivirus detection for dropped file 8->126 128 Found evasive API chain (may stop execution after checking mutex) 8->128 130 Contains functionality to check if Internet connection is working 8->130 136 4 other signatures 8->136 18 sysmsrvcx.exe 7 23 8->18         started        68 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 12->68 dropped 70 C:\Users\user\AppData\Local\...\mpnsrsgv.tmp, PE32+ 12->70 dropped 132 Sample is not signed and drops a device driver 12->132 134 Uses schtasks.exe or at.exe to add and modify task schedules 14->134 23 conhost.exe 14->23         started        25 conhost.exe 16->25         started        27 schtasks.exe 16->27         started        29 conhost.exe 16->29         started        31 2 other processes 16->31 signatures5 process6 dnsIp7 82 117.4.49.131, 40500 VIETEL-AS-APViettelGroupVN Viet Nam 18->82 84 100.109.71.254, 40500 UUNETUS Reserved 18->84 86 24 other IPs or domains 18->86 60 C:\Users\user\AppData\Local\...\287867994.exe, PE32 18->60 dropped 62 C:\Users\user\AppData\...\2501816270.exe, PE32 18->62 dropped 64 C:\Users\user\AppData\Local\...\195273646.exe, PE32 18->64 dropped 118 Antivirus detection for dropped file 18->118 120 Multi AV Scanner detection for dropped file 18->120 122 Found evasive API chain (may stop execution after checking mutex) 18->122 124 5 other signatures 18->124 33 195273646.exe 14 18->33         started        37 2501816270.exe 15 18->37         started        40 287867994.exe 18->40         started        file8 signatures9 process10 dnsIp11 52 C:\...\Windows Security Upgrade Service.exe, PE32 33->52 dropped 54 C:\Users\user\AppData\...\newpinf[1].exe, PE32 33->54 dropped 102 Antivirus detection for dropped file 33->102 104 Multi AV Scanner detection for dropped file 33->104 106 Machine Learning detection for dropped file 33->106 42 Windows Security Upgrade Service.exe 1 33->42         started        45 Windows Security Upgrade Service.exe 33->45         started        47 Windows Security Upgrade Service.exe 33->47         started        88 185.215.113.84, 49702, 49716, 5151 WHOLESALECONNECTIONSNL Portugal 37->88 56 C:\Users\user\AppData\...\3024012436.exe, PE32+ 37->56 dropped 58 C:\Users\user\AppData\Local\...\xmr[1].exe, PE32+ 37->58 dropped 108 Hides that the sample has been downloaded from the Internet (zone.identifier) 37->108 49 3024012436.exe 3 37->49         started        110 Found evasive API chain (may stop execution after checking mutex) 40->110 112 Contains functionality to check if Internet connection is working 40->112 114 Contains functionality to detect sleep reduction / modifications 40->114 file12 116 Detected Stratum mining protocol 88->116 signatures13 process14 file15 72 C:\Users\user\Desktop\eZvOzNlUAa.exe, PE32 42->72 dropped 74 C:\ProgramData\...\vcredist_x86.exe, PE32 42->74 dropped 76 C:\ProgramData\...\VC_redist.x64.exe, PE32 42->76 dropped 80 5 other malicious files 42->80 dropped 78 C:\Users\user\...\winsvrupd.exe, PE32+ 49->78 dropped 90 Antivirus detection for dropped file 49->90 92 Multi AV Scanner detection for dropped file 49->92 signatures16
Detection:
phorpiex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82/
Threat name:
Win32.Trojan.FWDisable
Create hunting rule
Status:
Malicious
First seen:
2023-02-27 07:21:50 UTC
File Type:
PE (Exe)
AV detection:
22 of 25 (88.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=agrumxs6b5qw2ydxrudr6xbdk77tazh7nqeaqycxkvxepztbd2ba._file
Verdict:
malicious
Similar samples:
09a3a72ed78683c5fbe62e66c33ba7d5dc8b77ca5f52965364e8d41d5622c29d
Phorpiex
12f308243fe099acdb7718428e027aa77846efa6f18e6cf8235daaadcb46ed1f
Phorpiex
48214f32e63f85fe88aff17257a746862d7530bce20b2dfc7a7b942743374a31
Phorpiex
4b56d0b0c8c52803bf7c21587bd98a16f73f0d6ed4e4153eee1964533ac394ee
Phorpiex
68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
Phorpiex
78a973ace68c9666e5ec28c53be0d2d36bde2d419c10fa6ed939156d199a18ef
Phorpiex
8377023d1c79ff357599359d7d252ec086c53061d6064690791d7ac2679a94dd
Phorpiex
94e2fe84aeea801b0ddcf49c74375bb23ec242d30edc39fccd296ed2e7b64f72
Phorpiex
a1650255f850fabb19b9b75865cef9bd45d89a48390f585f3587da14b7484908
Phorpiex
e249064e0227b91181a4cc52d2af88b56d10a01cafea2a4962dca3155f0a37d2
Phorpiex
+ 29 additional samples on MalwareBazaar
Result
Malware family:
phorphiex
Create hunting rule
Score:
  10/10
Tags:
family:phorphiex loader persistence trojan worm
Link:
https://tria.ge/reports/230227-tynmcsec9t/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Adds Run key to start application
Executes dropped EXE
Phorphiex
Malware Config
C2 Extraction:
http://185.215.113.66/
Unpacked files
SH256 hash:
01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
MD5 hash:
19076f70cf529cbcb260befcc4595f1a
SHA1 hash:
e24619c6cc207f9ff26ca0ff553901de2e688ca0
Link:
https://www.unpac.me/results/238d90a1-7ab5-4d89-ab8d-2892fcc2234c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Phorpiex

Executable exe 01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2540967/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2531892/
  
URLhaus
https://urlhaus.abuse.ch/url/2423598/
Cape
Cape
https://www.capesandbox.com/analysis/370338/

Comments