MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b901f2320a7011a69a6b7013bc99be0e904f55f1bc37b3091b014e894bc3db24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Phorpiex


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b901f2320a7011a69a6b7013bc99be0e904f55f1bc37b3091b014e894bc3db24
SHA3-384 hash: 0993ec2f3706fe4541a9c1dbfe7cd9d4a73f2402aec3d4fab475759f7e3e071943285c5ecc8f0bf59386339e458e76cb
SHA1 hash: d4a975a866b4e4227a90168e0bc4ef7542ac4bfd
MD5 hash: e28c6a5e9f89694a0237fe4966a6c32c
humanhash: quebec-april-florida-oxygen
File name:SecuriteInfo.com.Win32.Herz.B.29906.8032
Download: download sample
Signature Phorpiex
Create hunting rule
File size:967'680 bytes
First seen:2020-05-23 11:46:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 179f503f2595426f809b8b283fc488b8 (2 x Phorpiex)
ssdeep 3072:M/l1TNbnAm2MdyEa+PIO6NWOhP3E7frdw/DFjBp2P3+c:6l1TxAmNkWaPUsFjLn
Threatray 654 similar samples on MalwareBazaar
TLSH F2253B6AF75188A3F0321D70486FCA7111E2BC546010551E76AA3F2F79F63622AAF71F
Reporter SecuriteInfoCom
Tags:Phorpiex

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Herz.B.29906.8032.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fsysna
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 19:05:35 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc
Phorpiex
68657be04f5b550fec4671437e5dc5849408eada96f5ff44cb0972b0e28ca5be
Phorpiex
91e6f72cd4a4721915609abef27afcb72f170739c51384332da3cb6a8bb8f150
Phorpiex
ac42965215afb055c4135cc87288be3f2aaff848972634fbaed4c365e112af43
Phorpiex
b05a3383d846cfb3c60eb9d4c494964e15defc9fc767263be629913240b42353
Phorpiex
d03c04a685a0a4f735c0456cb4d1073792a19ea0fbf18a0c28d7b445798a4a18
Phorpiex
d073113b0667727d37e9c798f33cecf60b698e4d8c13f68ec8c6c75cd18ba7fe
Phorpiex
e9c665ae63c57f3e16936a31f9b1ad164705574ad95575f8b0cbcafc6a185799
Phorpiex
f8a3b64aa3c1c639a5ce1b100de860d4f97703879df0d01ce0118ae97c1b7423
Phorpiex
fe1330ade7fc1f8722e4aeabe15b57c1ff3d18b483dd273fe1df7cef3e27f8bf
Phorpiex
+ 644 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/201109-m5bg9v9rma/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Loads dropped DLL
Windows security modification
Executes dropped EXE
ServiceHost packer
Modifies Windows Defender Real-time Protection settings
Windows security bypass
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_phorpiex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Phorpiex

Executable exe b901f2320a7011a69a6b7013bc99be0e904f55f1bc37b3091b014e894bc3db24

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/347736/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/347804/
  
URLhaus
https://urlhaus.abuse.ch/url/347735/
  
URLhaus
https://urlhaus.abuse.ch/url/336680/
  
URLhaus
https://urlhaus.abuse.ch/url/313333/
  
URLhaus
https://urlhaus.abuse.ch/url/313397/
  
URLhaus
https://urlhaus.abuse.ch/url/220752/
  
URLhaus
https://urlhaus.abuse.ch/url/210135/
  
URLhaus
https://urlhaus.abuse.ch/url/213556/
  
URLhaus
https://urlhaus.abuse.ch/url/367142/
  
URLhaus
https://urlhaus.abuse.ch/url/367143/
  
URLhaus
https://urlhaus.abuse.ch/url/367144/

Comments