MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Phorpiex


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
SHA3-384 hash: 86282f25380e001368c1be88d98f5190485701b58599a98dc745379d24f35328aacf24ad79bba2d1ed7c27bfed6f492e
SHA1 hash: e971641482d77987e082289c38388052465b2117
MD5 hash: 45fcc38f53e4ba514815477f91618a47
humanhash: ink-magazine-cola-uniform
File name:SecuriteInfo.com.Win32.KadrBot.3776.11399
Download: download sample
Signature Phorpiex
Create hunting rule
File size:74'752 bytes
First seen:2022-11-17 18:48:38 UTC
Last seen:2022-11-17 19:45:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 83bcccb089013e02973a47f8d54106e0 (6 x Phorpiex)
ssdeep 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
Threatray 40 similar samples on MalwareBazaar
TLSH T1E8733900F550C13BF4F740FFE2BB14AE5929AFA4434598DB22D4689FAB316C1B93259B
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter SecuriteInfoCom
Tags:exe Phorpiex

Intelligence

File Origin
# of uploads :
2
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b6007538167ca115bafb5aaf7ecc9956.exe
Verdict:
Malicious activity
Analysis date:
2022-11-17 15:28:15 UTC
Tags:
loader
Link:
https://app.any.run/tasks/b0db043b-0baf-4383-8a0d-5dffdb72f8df

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/335518/
Detection(s):
SecuriteInfo.com.Win32.KadrBot.3776.11399.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file in the Windows directory
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a window
DNS request
Creating a file in the %temp% directory
Sending a UDP request
Creating a file
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Blocking the Windows Security Center notifications
Creating a file in the mass storage device
Unauthorized injection to a recently created process
Enabling threat expansion on mass storage devices
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware phorpiex shell32.dll
Link:
https://www.filescan.io/uploads/6376821e8d07bb59f81b0e42/reports/52dcdfab-5356-4cc8-aec3-2bb276c3c830/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/66369995-83f2-4541-b7dc-c94d2094f4bb
Result
Threat name:
Phorpiex, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1116051
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to check if Internet connection is working
Contains functionality to detect sleep reduction / modifications
Detected Stratum mining protocol
Drops executables to the windows directory (C:\Windows) and starts them
Found evasive API chain (may stop execution after checking mutex)
Found hidden mapped module (file has been removed from disk)
Found strings related to Crypto-Mining
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Phorpiex
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 748762 Sample: SecuriteInfo.com.Win32.Kadr... Startdate: 17/11/2022 Architecture: WINDOWS Score: 100 85 Snort IDS alert for network traffic 2->85 87 Antivirus detection for URL or domain 2->87 89 Antivirus detection for dropped file 2->89 91 9 other signatures 2->91 9 SecuriteInfo.com.Win32.KadrBot.3776.11399.exe 1 1 2->9         started        13 winsvrupd.exe 4 2->13         started        15 powershell.exe 13 2->15         started        17 4 other processes 2->17 process3 file4 69 C:\Windows\sysredvcs.exe, PE32 9->69 dropped 111 Found evasive API chain (may stop execution after checking mutex) 9->111 113 Contains functionality to check if Internet connection is working 9->113 115 Drops executables to the windows directory (C:\Windows) and starts them 9->115 121 2 other signatures 9->121 19 sysredvcs.exe 7 22 9->19         started        71 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 13->71 dropped 73 C:\Users\user\AppData\Local\...\mpnsrsgv.tmp, PE32+ 13->73 dropped 117 Maps a DLL or memory area into another process 13->117 119 Sample is not signed and drops a device driver 13->119 24 cmd.exe 13->24         started        26 conhost.exe 15->26         started        28 schtasks.exe 1 15->28         started        30 WMIC.exe 1 17->30         started        32 conhost.exe 17->32         started        34 conhost.exe 17->34         started        36 conhost.exe 17->36         started        signatures5 process6 dnsIp7 77 185.215.113.66, 49699, 49701, 49703 WHOLESALECONNECTIONSNL Portugal 19->77 79 187.235.152.233, 40500 UninetSAdeCVMX Mexico 19->79 81 24 other IPs or domains 19->81 61 C:\Users\user\AppData\Local\...\75431137.exe, PE32 19->61 dropped 63 C:\Users\user\AppData\...\2528027824.exe, PE32+ 19->63 dropped 93 Antivirus detection for dropped file 19->93 95 Found evasive API chain (may stop execution after checking mutex) 19->95 97 Contains functionality to check if Internet connection is working 19->97 99 4 other signatures 19->99 38 75431137.exe 15 19->38         started        43 2528027824.exe 2 19->43         started        file8 signatures9 process10 dnsIp11 83 185.215.113.84, 49702, 49715, 5151 WHOLESALECONNECTIONSNL Portugal 38->83 65 C:\Users\user\AppData\...\1419930614.exe, PE32+ 38->65 dropped 67 C:\Users\user\AppData\Local\...\xmr[1].exe, PE32+ 38->67 dropped 101 Antivirus detection for dropped file 38->101 103 Multi AV Scanner detection for dropped file 38->103 105 Machine Learning detection for dropped file 38->105 107 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->107 45 1419930614.exe 3 38->45         started        49 cmd.exe 1 43->49         started        51 cmd.exe 1 43->51         started        file12 109 Detected Stratum mining protocol 83->109 signatures13 process14 file15 75 C:\Users\user\...\winsvrupd.exe, PE32+ 45->75 dropped 123 Antivirus detection for dropped file 45->123 125 Multi AV Scanner detection for dropped file 45->125 127 Uses schtasks.exe or at.exe to add and modify task schedules 49->127 53 conhost.exe 49->53         started        55 reg.exe 1 49->55         started        57 conhost.exe 51->57         started        59 schtasks.exe 1 51->59         started        signatures16 process17
Detection:
phorpiex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc/
Threat name:
Win32.Trojan.FWDisable
Create hunting rule
Status:
Malicious
First seen:
2022-11-03 20:30:25 UTC
File Type:
PE (Exe)
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ndorlq4e43l3h7dk73njuf67t75fl3jjqypjeslvcselaov2yl6a._file
Verdict:
malicious
Similar samples:
22f524abc98f958705febd3761bedc85ec1ae859316a653b67c0c01327533092
Phorpiex
4be45155e4f00c417a85688e2d31587ee82fe60dfc5c81a7c901ea703a179017
Phorpiex
52ba74cb8d846646b2b59b2a618e470416ef0ec40059420c0951db00b56e9b99
Phorpiex
8377023d1c79ff357599359d7d252ec086c53061d6064690791d7ac2679a94dd
Phorpiex
9ac6aabe5f916e190055913ff7b161356c5b4e5e3d99b5036cf3675751bc765a
Phorpiex
ba7a55b17174de39cb44b553a52de3d0b3c979d37104a5ad1580cb97a8acc800
Phorpiex
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d
Phorpiex
e249064e0227b91181a4cc52d2af88b56d10a01cafea2a4962dca3155f0a37d2
Phorpiex
ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
Phorpiex
+ 30 additional samples on MalwareBazaar
Result
Malware family:
phorphiex
Create hunting rule
Score:
  10/10
Tags:
family:phorphiex evasion loader persistence trojan worm
Link:
https://tria.ge/reports/221117-xgbg9abc2y/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Windows security modification
Executes dropped EXE
Phorphiex
Windows security bypass
Malware Config
C2 Extraction:
http://185.215.113.66/twizt/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/24b2db5d-d04d-4c53-8e4c-a265e52dc672
Unpacked files
SH256 hash:
68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 hash:
45fcc38f53e4ba514815477f91618a47
SHA1 hash:
e971641482d77987e082289c38388052465b2117
Link:
https://www.unpac.me/results/774ed9e3-83a6-44d7-b5b4-6840f2d8f203/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/68dd15c384e6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Phorpiex

Executable exe 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1960874/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2274787/
  
URLhaus
https://urlhaus.abuse.ch/url/2272063/
  
URLhaus
https://urlhaus.abuse.ch/url/2423598/
Cape
Cape
https://www.capesandbox.com/analysis/335518/

Comments