MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a93b5aa6842c92672551cd07a323395b628aa6706f4ce7019d3d4391af78e8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Phorpiex


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a93b5aa6842c92672551cd07a323395b628aa6706f4ce7019d3d4391af78e8b
SHA3-384 hash: 6e550c8a54acaf5124b1601e8d2c51ec9c33291aa987e9fcfdc5172b48df91d4bab56c9d702c1406695e6d216788d966
SHA1 hash: 79e4f34f642ed2237ad05c31813587826351d5ea
MD5 hash: d60d63045721ecb7a37b5a95ddbed28d
humanhash: fifteen-angel-carbon-south
File name:DeviceConfigManager.exe
Download: download sample
Signature Phorpiex
Create hunting rule
File size:141'092 bytes
First seen:2020-09-29 17:58:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e160ef8e55bb9d162da4e266afd9eef3 (140 x GuLoader, 33 x RemcosRAT, 17 x AgentTesla)
ssdeep 3072:e8Dsp+FNX1dFOvDlXJuL45by/9NHI0eNsoRn9EH2HLB4cf5yLljFoyNn:e8dNXSELoy/9NHwNN9EHyVN6ldNn
Threatray 288 similar samples on MalwareBazaar
TLSH 34D3F113B3C1A5FFDB9506328477ABB9C73AA6989315AE431700DE7EADB1483CE194D0
Reporter Anonymous
Tags:Phorpiex

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/66831/
Detection(s):
Win.Trojan.Coinminer-7139643-0
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Delayed reading of the file
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/477738
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contain functionality to detect virtual machines
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a93b5aa6842c92672551cd07a323395b628aa6706f4ce7019d3d4391af78e8b/
Threat name:
Win32.Trojan.Kryptomix
Create hunting rule
Status:
Malicious
First seen:
2017-11-07 07:31:23 UTC
AV detection:
37 of 42 (88.10%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
12294db47384dc27b2fa9acf8167d7a0562a8d80aee861af40dc551a5b47ef34
Phorpiex
14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f
Phorpiex
1e1684d4513c0c3ad9d15fb28b65edbb505977729bc60c61dd7f69c484bc08a2
Phorpiex
2fcab21d4d5863ef934dd19e96379fb5e796b9ae4d77d1d6784bfc25887ffacb
Phorpiex
6b85fd7249ceaf4a88f71ad1becb27b9c9a17b1c1bd2cb75f25cdc7b1318785a
Phorpiex
94596876e5408289110c03aee0bf01dda5d9632d4614041e644bf4809fc46b5f
Phorpiex
a06666a038da798e0c447ffe397f4a3e5c054780e541149f9faea175830b1e2f
Phorpiex
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19
Phorpiex
dafdcd9e9b75c4d7187fcfb384788bf5925a1a3426eb7e6d3cc2147b5e9bdc66
Phorpiex
fba8817602cb7dae175d9fec0900fbfd3e097aae4d32befaecd87d6e3fdb7412
Phorpiex
+ 278 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/200929-q63t88y37n/
Behaviour
Loads dropped DLL
Unpacked files
SH256 hash:
01839dd6aa5c3c13b6ffcd017d18bd8d196c975d6001fe6bf01b8b6f80c9afef
MD5 hash:
2f728f43e76c2ad3cde6ea04227e323a
SHA1 hash:
8f042516cbe40b5d66f82cf3261a8c8d0ac5b2b7
Link:
https://www.unpac.me/results/3dd6b96f-db70-40b0-a8be-2cef060504fb/
SH256 hash:
cf67bb7bb8e070c2c581b7a48fce8de111c95c04fc7346b51e821f81f53360e3
MD5 hash:
acd7eb62ef7017b965cd9d9c67a94d47
SHA1 hash:
8c76a400b70865076469cc46b96fc578b42e4317
Detections:
win_phorpiex_g1
Create hunting rule
win_phorpiex_auto
Create hunting rule
Link:
https://www.unpac.me/results/3dd6b96f-db70-40b0-a8be-2cef060504fb/
SH256 hash:
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b
MD5 hash:
b8992e497d57001ddf100f9c397fcef5
SHA1 hash:
e26ddf101a2ec5027975d2909306457c6f61cfbd
Link:
https://www.unpac.me/results/3dd6b96f-db70-40b0-a8be-2cef060504fb/
SH256 hash:
0a93b5aa6842c92672551cd07a323395b628aa6706f4ce7019d3d4391af78e8b
MD5 hash:
d60d63045721ecb7a37b5a95ddbed28d
SHA1 hash:
79e4f34f642ed2237ad05c31813587826351d5ea
Link:
https://www.unpac.me/results/3dd6b96f-db70-40b0-a8be-2cef060504fb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Sdbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a93b5aa6842c92672551cd07a323395b628aa6706f4ce7019d3d4391af78e8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_phorpiex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_phorpiex_g1
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/66831/

Comments