MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e53b7f74cba1228b9f406c04e0ec580f4597d6de93cb5cdbf51564fee4111ead. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Phorpiex

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	e53b7f74cba1228b9f406c04e0ec580f4597d6de93cb5cdbf51564fee4111ead
SHA3-384 hash:	bb8ab8d0cf70b6b705566a7a424a3caef767dd70d6779fb2661ce2ac9d583c3769dcfa2805999e3a4dbd23bad73820f4
SHA1 hash:	f1d92a433e7fe4e17c349ebabad629e4fb814af3
MD5 hash:	5790ee7642277ac3ab4df17ba016754d
humanhash:	black-vermont-angel-eighteen
File name:	SecuriteInfo.com.Trojan.Siggen10.41067.16574.2807
Download:	download sample
Signature	Phorpiex Create hunting rule
File size:	75'776 bytes
First seen:	2020-10-25 22:55:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4ca962fd475e46eae1935406bdb62435 (4 x Phorpiex)
ssdeep	768:B33flOaKern+0UoJJNeFaTsBFWIw/Q1v0FFHOvFo0z4NbXCMH/SsN9+t+JYh/vXh:B3PlOPmnbeFh6Iw/Q1vaT0Kj
TLSH	D6734C2576516BF0E0E049726D77E67F9B877CB8AE21818376C0B32F11398A3D923467
Reporter	SecuriteInfoCom
Tags:	Phorpiex

Intelligence

File Origin

# of uploads :

# of downloads :

103

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/78035/

Detection(s):

SecuriteInfo.com.Trojan.Siggen10.41067.16574.2807.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Searching for the window

Searching for many windows

Creating a file

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

DNS request

Creating a file in the %temp% directory

Creating a file in the %AppData% subdirectories

Running batch commands

Creating a process with a hidden window

Launching a process

Changing a file

Reading critical registry keys

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Blocking the Windows Security Center notifications

Creating a file in the mass storage device

Blocking the User Account Control

Deleting volume shadow copies

Stealing user critical data

Enabling threat expansion on mass storage devices by creating a special LNK file

Sending an HTTP GET request to an infection source

Enabling autorun by creating a file

Encrypting user's files

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/510829

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Changes security center settings (notifications, updates, antivirus, firewall)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e53b7f74cba1228b9f406c04e0ec580f4597d6de93cb5cdbf51564fee4111ead/

Threat name:

Win32.Worm.Phorpiex

Status:

Malicious

First seen:

2020-10-22 08:16:45 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4u5x65gluerixh2anqcob3cyb5czpvw6spfvzw7vcvsp5zard2wq._file

Result

Malware family:

avaddon

Score:

10/10

Tags:

ransomware evasion trojan persistence family:avaddon

Link:

https://tria.ge/reports/201025-5my481w3r2/

Behaviour

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System policy modification

Modifies service

Adds Run key to start application

Checks whether UAC is enabled

Drops desktop.ini file(s)

Enumerates connected drives

Loads dropped DLL

Windows security modification

Executes dropped EXE

Modifies extensions of user files

Deletes shadow copies

Avaddon

Avaddon Ransomware

UAC bypass

Windows security bypass

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Phorpiex

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/e53b7f74cba1228b9f406c04e0ec580f4597d6de93cb5cdbf51564fee4111ead

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.