phorpiex: 025f5798 — MSVC9 thin HTTP downloader, earlier build (13:06 UTC) missing 15.exe payload

Executive Summary

A confirmed campaign sibling of phorpiex downloader 6b8527a7. Same 10 KB PE32 MSVC9 build, same C2 (178.16.54.109), same payload naming convention (14.exe, peinf.exe, xmr.exe, xmrget.exe, grab.exe), same marker-file gating, same dual WinInet+URLMon fetch, same Zone.Identifier cleanup, same x64+Win11 build gating via RtlGetVersion. The only material delta: compiled 3 hours 51 minutes earlier (2026-05-22 13:06:11 UTC vs 16:56:51 UTC) and omits the 15.exe fetch present in the later build. Static-only (no CAPE). ^[rabin2-info.txt:11] ^[pefile.txt:33]

What It Is

OpenCTI label: dropped-by-phorpiex. Confidence medium — umbrella campaign label. For complete family characterization, shared build traits, and full TTP mapping, see /intel/analyses/6b8527a7f761e8a5489b81ea8a79cbbbd9c09485b9b5d7c28cd892ef66599339.html and entities/phorpiex.md. This report covers only per-sample deltas.

Decompiled Behavior

Entry point is honest MSVCR90 CRT: __wgetmainargs → __tmainCRTStartup → main at 0x4014b3. No initterm hijack. ^[r2:entry0]

main sleeps 2000 ms, then drives a flat sequential fetch: ^[r2:sym.main]

1. Download http://178.16.54.109/14.exe → write %TEMP%\<rand>_<rand>.exe → execute via CreateProcessW (CREATE_NO_WINDOW) with ShellExecuteW fallback.
2. Download http://178.16.54.109/peinf.exe → same write+execute.
3. Gate A — check %appdata%\d3333333333333333333.txt. If absent, create and proceed; else skip to Gate D.
4. Gate B — PathFileExistsW("%SYSTEMDRIVE%\Program Files (x86)") (x64 indicator). ^[r2:fcn.004013e5]
5. If Gate B passes: download xmr.exe → execute.
6. Gate C — RtlGetVersion via GetProcAddress(ntdll.dll); require Major==10, Minor==0, BuildNumber>0x55f0 (Win11 / recent Win10). ^[r2:fcn.00401435]
7. If Gate C passes: download xmrget.exe → execute.
8. Gate D — check %appdata%\f3f3f3d3d.txt. If absent, create and proceed; else return.
9. If Gate D passes: download grab.exe → execute.

Downloader Routine (fcn.004010a8)

Identical to sibling 6b8527a7: ^[r2:fcn.004010a8]

• Seed PRNG with GetTickCount().
• InternetOpenW with hardcoded Chrome 128 UA (Win64; x64 from a 32-bit binary).
• WinInet primary: InternetOpenUrlW → InternetReadFile (4 KB chunks) → CreateFileW → WriteFile.
• DeleteFileW on %s:Zone.Identifier to strip origin ADS.
• Sleep 1 s, then execution helper.
• Fallback: random sleep up to ~5 min (rand() % 0xEA60 * 5), regenerate filename, URLDownloadToFileW.
• Repeat Zone.Identifier deletion and execution.

Execution Helper (section..text @ 0x401000)

^[r2:section..text]

• CreateProcessW with dwCreationFlags = 0x20 (CREATE_NO_WINDOW).
• On failure: ShellExecuteW(hwnd=NULL, verb=L"open", file=path, nShowCmd=0) (SW_HIDE).
• Sleep 1 s, close handles.

Marker-File Gates

• Gate A (fcn.004012fb): expand %appdata%, PathCombineW → d3333333333333333333.txt, CreateFileW if absent.
• Gate D (fcn.00401370): expand %appdata%, PathCombineW → f3f3f3d3d.txt, CreateFileW if absent. ^[r2:fcn.004012fb] ^[r2:fcn.00401370]

Build Gating

• x64 detection: PathFileExistsW("%SYSTEMDRIVE%\Program Files (x86)") — cheap architecture probe. ^[r2:fcn.004013e5]
• OS build detection: load ntdll.dll → resolve RtlGetVersion → populate 0x114-byte RTL_OSVERSIONINFOW → check dwMajorVersion==10, dwMinorVersion==0, dwBuildNumber>0x55f0 (21999). ^[r2:fcn.00401435]

No IsDebuggerPresent call in execution path (import appears as unused CRT artifact). No VM checks. No string encryption. No packing.

C2 Infrastructure

Single cleartext HTTP IP. No domain, no HTTPS, no rotation.

Delta from sibling 6b8527a7: 15.exe is absent from both strings and decompiled flow. Likely added in the later 16:56 build. ^[strings.txt] ^[r2:sym.main]

Deploy / ATT&CK

Static-only inference. No runtime data.

No persistence mechanism observed in this binary. The downloader writes no Run keys, tasks, or services. Persistence relies on spam re-delivery or follow-on payloads.

Deployable Signatures

YARA

rule phorpiex_msvc9_thin_downloader {
    meta:
        description = "Phorpiex campaign MSVC9 thin HTTP downloader (10 KB, dual-fetch, Zone.Identifier cleanup)"
        author = "triage"
        reference = "/intel/analyses/025f57988953e3d23e1657a9af5610887e57c5390a82f73b4b2b99c30eef3b70.html"
        date = "2026-06-07"
        hash = "025f57988953e3d23e1657a9af5610887e57c5390a82f73b4b2b99c30eef3b70"
    strings:
        $ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" wide
        $ip = "http://178.16.54.109/" ascii
        $zone = "%s:Zone.Identifier" wide
        $marker_a = "d3333333333333333333.txt" wide
        $marker_b = "f3f3f3d3d.txt" wide
        $temp_fmt = "%s\\%d%d.exe" wide
        $crt = "MSVCR90.dll" ascii
        $wininet = "WININET.dll" ascii
        $urlmon = "urlmon.dll" ascii
        $manifest_v1 = "Microsoft.VC90.CRT" ascii
    condition:
        uint16(0) == 0x5A4D and
        filesize < 15KB and
        pe.number_of_sections == 5 and
        pe.imports("MSVCR90.dll", "_snwprintf") and
        pe.imports("MSVCR90.dll", "srand") and
        pe.imports("WININET.dll", "InternetOpenW") and
        pe.imports("urlmon.dll", "URLDownloadToFileW") and
        4 of ($ua, $ip, $zone, $marker_a, $marker_b, $temp_fmt)
}

Behavioral Fingerprint

A ~10 KB PE32 MSVC9 executable compiled May 2026, linking MSVCR90.dll, WININET.dll, urlmon.dll, and SHLWAPI.dll. On launch it sleeps 2 seconds, then fetches up to five payloads over cleartext HTTP from 178.16.54.109 using a hardcoded Chrome 128 64-bit User-Agent. Downloads are written to randomly-named files in %TEMP% before the Zone.Identifier ADS is deleted. Execution uses CreateProcessW (CREATE_NO_WINDOW) with a ShellExecuteW fallback. Two marker files in %appdata% (d3333333333333333333.txt, f3f3f3d3d.txt) gate later payloads. Architecture and OS build gating (RtlGetVersion, PathFileExistsW on Program Files (x86)) steer cryptocurrency mining payloads toward modern x64 Windows hosts. No packing, no string encryption, no persistence.

IOCs

Interesting Tidbits

• Live campaign, two builds in one day: 025f57 compiled at 13:06 UTC; sibling 6b8527a7 at 16:56 UTC — a 3h51m iteration cycle adding 15.exe. Rapid iteration suggests active A/B testing or incremental payload expansion. ^[pefile.txt:33]
• Honest entry point: Unlike older Phorpiex siblings (e.g. 755bed07) that hijack _initterm to stage payload before main(), both 025f57 and 6b8527a7 use a standard CRT startup → main() flow. The initterm technique appears to have been retired in this campaign wave. ^[r2:entry0]
• Zero anti-analysis beyond Sleep: No IsDebuggerPresent usage, no VM checks, no export obfuscation, no API hashing. The binary is functionally transparent — a sign of crimeware commodity tooling optimized for volume over stealth. ^[r2:sym.imp.KERNEL32.dll_IsDebuggerPresent]

References

• Sibling analysis: /intel/analyses/6b8527a7f761e8a5489b81ea8a79cbbbd9c09485b9b5d7c28cd892ef66599339.html
• Family entity: phorpiex
• Technique: wininet-urlmon-dual-download
• Technique: marker-file-mutex-gating

Provenance

• file.txt — file command output
• pefile.txt — pefile python library header dump
• rabin2-info.txt — radare2 rabin2 -I summary
• strings.txt — strings -n 6 raw ASCII/Unicode strings
• yara.txt — yara rules output
• exiftool.json — ExifTool PE metadata
• dynamic-analysis.md — CAPE status (skipped)
• Radare2 analysis: level-3 analysis (aaa), decompilation via pdc on functions entry0, main, fcn.004010a8, fcn.00401000, fcn.004012fb, fcn.00401370, fcn.004013e5, fcn.00401435