MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 329ea43f5027e79bb3151ce827fadbc6173a84218fd984ae4a4b44b478411339. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Phorpiex


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 329ea43f5027e79bb3151ce827fadbc6173a84218fd984ae4a4b44b478411339
SHA3-384 hash: 3cf0c6211bcf692742b67acb6630abdd35951dc4eceac52447aef972196657da8d9030bab1952f49b239e27839fea90f
SHA1 hash: 965b86352f0a5aea6969be8466e5318a0152b32a
MD5 hash: 1270d03503499a3dc08a3d959ded61f5
humanhash: eighteen-montana-white-twelve
File name:1270d03503499a3dc08a3d959ded61f5.exe
Download: download sample
Signature Phorpiex
Create hunting rule
File size:36'352 bytes
First seen:2021-02-03 18:38:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ae0db3311fb89eb34ba9c50ba34bdd38 (3 x Phorpiex)
ssdeep 768:X+aNkKY50fCHDJZMvbfRBJ/useFGcPiPiPiP5hohohohohohohohohohohohohoh:nkKYefCHNZybfleFBPiPiPiP5hohohoB
Threatray 27 similar samples on MalwareBazaar
TLSH 20F2C87DBD30092AF07285F823B656FF472ABC711680A6CFAE6852511E318D1FAF4D16
Reporter abuse_ch
Tags:exe Phorpiex

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
329ea43f5027e79bb3151ce827fadbc6173a84218fd984ae4a4b44b478411339
Verdict:
No threats detected
Analysis date:
2021-02-03 14:18:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/109347e6-7e59-48af-8fae-52f1aad95bd0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/115420/
Detection(s):
Win.Malware.Zard-9793613-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Searching for many windows
Sending a UDP request
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file in the %temp% directory
Connection attempt
Searching for the window
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Blocking the Windows Defender launch
Blocking the Windows Security Center notifications
Creating a file in the mass storage device
Enabling threat expansion on mass storage devices by creating a special LNK file
Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Phorpiex Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/598333
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Detected Stratum mining protocol
Drops PE files with benign system names
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Tries to detect the country of the analysis system (by using the IP)
Writes to foreign memory regions
Yara detected Phorpiex
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 348202 Sample: jlgqO9Afwh.exe Startdate: 03/02/2021 Architecture: WINDOWS Score: 100 95 Multi AV Scanner detection for domain / URL 2->95 97 Antivirus detection for URL or domain 2->97 99 Antivirus detection for dropped file 2->99 101 13 other signatures 2->101 10 jlgqO9Afwh.exe 2 16 2->10         started        15 svchost.exe 13 2->15         started        17 svchost.exe 9 1 2->17         started        19 12 other processes 2->19 process3 dnsIp4 87 api.wipmania.com 212.83.168.196, 49719, 49725, 49732 OnlineSASFR France 10->87 69 C:\100421962310489\svchost.exe, PE32 10->69 dropped 121 Drops PE files with benign system names 10->121 123 Hides that the sample has been downloaded from the Internet (zone.identifier) 10->123 21 svchost.exe 7 30 10->21         started        125 System process connects to network (likely due to code injection or exploit) 15->125 89 tsrv3.ru 127.0.0.1 unknown unknown 17->89 91 192.168.2.1 unknown unknown 19->91 26 MpCmdRun.exe 19->26         started        file5 signatures6 process7 dnsIp8 79 worm.ws 194.147.142.11, 49730, 49731, 49733 PTPEU unknown 21->79 81 tsrv4.ws 185.215.113.10, 49752, 49766, 80 WHOLESALECONNECTIONSNL Portugal 21->81 83 2 other IPs or domains 21->83 59 C:\Users\user\AppData\...\3823024404.exe, data 21->59 dropped 61 C:\Users\user\AppData\...\2859039326.exe, data 21->61 dropped 63 C:\Users\user\AppData\...\2515224510.exe, data 21->63 dropped 65 2 other malicious files 21->65 dropped 103 Antivirus detection for dropped file 21->103 105 System process connects to network (likely due to code injection or exploit) 21->105 107 Multi AV Scanner detection for dropped file 21->107 111 3 other signatures 21->111 28 2515224510.exe 21->28         started        32 2859039326.exe 13 21->32         started        35 3823024404.exe 13 21->35         started        39 2 other processes 21->39 37 conhost.exe 26->37         started        file9 109 Detected Stratum mining protocol 79->109 signatures10 process11 dnsIp12 71 C:\Users\user\AppData\Local\Temp\16163.exe, PE32 28->71 dropped 73 C:\Users\user\AppData\Local\...\xmr[1].exe, PE32 28->73 dropped 127 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->127 41 16163.exe 28->41         started        75 api.wipmania.com 32->75 77 api.wipmania.com 35->77 file13 signatures14 process15 dnsIp16 85 worm.top 41->85 67 C:\ProgramData\PnQssBdbSh\winsysdrv, PE32 41->67 dropped 113 Antivirus detection for dropped file 41->113 115 Multi AV Scanner detection for dropped file 41->115 117 Machine Learning detection for dropped file 41->117 119 4 other signatures 41->119 46 notepad.exe 41->46         started        50 cmd.exe 41->50         started        file17 signatures18 process19 dnsIp20 93 worm.ws 46->93 129 System process connects to network (likely due to code injection or exploit) 46->129 52 wscript.exe 50->52         started        55 conhost.exe 50->55         started        signatures21 process22 file23 57 C:\Users\user\AppData\...\ulZYCdTsml.url, MS 52->57 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/329ea43f5027e79bb3151ce827fadbc6173a84218fd984ae4a4b44b478411339/
Threat name:
Win32.Worm.Phorpiex
Create hunting rule
Status:
Malicious
First seen:
2021-02-03 16:51:26 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkpkip2qe7tzxmyvdtucp6w3yyltvbbbr7myjlskjncli6cbcm4q._file
Verdict:
suspicious
Similar samples:
2dc0e02fcc1a56c81903905869a396f328813e63eba46f941ff3379430e12d12
Phorpiex
38637b0bf898df12f7549c595eb255b38995e8da8058bff700428d90e98052c1
Phorpiex
53cae19aa470b038966c47f8e7361fde1da99f4f54ea97ab3fb7198506ecbc3d
Phorpiex
5d9b6c49a8c84b01122da49a1237c880e2eb71d44f264e8a0effc56b7b586bf6
Phorpiex
7c419f22e51f37be0c483bbf3c320c40b6939785896b756c504af5de5b46237f
Phorpiex
7e663d31d2d1fb89bb88dfa65fea415d754e5a9e6d804cf99c59d98f95580945
Phorpiex
d8489f43ed8b96cd5f5b28f6e570dbb57571656869c7b0a8ba215fb375857070
Phorpiex
e053c19ffe23b6e0b58165395bfd1ed11b9df981e99ac8f6f5cfe9fcbddd2579
Phorpiex
e6e1567dba427fd20cec7ffd9a830a1f144db637856ae7567d257387b0218f63
Phorpiex
fe3428c2f1613c72ef1612b6876239ec8cc058628e8240664315359802215af1
Phorpiex
+ 17 additional samples on MalwareBazaar
Result
Malware family:
phorphiex
Create hunting rule
Score:
  10/10
Tags:
family:phorphiex evasion loader persistence trojan worm
Link:
https://tria.ge/reports/210203-dxepvdwgp6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Windows security modification
Executes dropped EXE
Phorphiex Payload
Phorphiex Worm
Windows security bypass
Unpacked files
SH256 hash:
329ea43f5027e79bb3151ce827fadbc6173a84218fd984ae4a4b44b478411339
MD5 hash:
1270d03503499a3dc08a3d959ded61f5
SHA1 hash:
965b86352f0a5aea6969be8466e5318a0152b32a
Link:
https://www.unpac.me/results/c7d19743-38de-446d-920f-c89453ff5c5e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Phorpiex
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/329ea43f5027e79bb3151ce827fadbc6173a84218fd984ae4a4b44b478411339

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Phorpiex

Executable exe 329ea43f5027e79bb3151ce827fadbc6173a84218fd984ae4a4b44b478411339

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/621240/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/115420/

Comments