phorphiex | 0680b4651f1c40d8328ea683b711aad09f3bdb97a8564595d5ae27e77b831395

General

Target
2026-05-23_5b8dfae4dea239e64d3de19a5da9476b_elex_wannacry
Size 24KB
Sample260523-kdaekaey8p
SHA256 0680b4651f1c40d8328ea683b711aad09f3bdb97a8564595d5ae27e77b831395
MD5 5b8dfae4dea239e64d3de19a5da9476b
SHA1 91856deac0d4e299c4f771ceb2b0ca3e271f7da0
SHA512 f521b1e72a462606e001b47b32ce342f22df29295497cbcbd107a2d5c302f1a0c92672af8b2665f7d6ad209913e424f227c18a17e6dd42009b83d08a65fb9c93
SSDEEP 192:oxpice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEBCvu1pFaGSmDaKu:ox1vkaG16eSlBY2ZZfu1OPP
TLSH
T142B2E602E6A586A6E210CDB207BB5E3A0935B4771B4556CFA791CF5DB830FC09C22B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-05-23_5b8dfae4dea239e64d3de19a5da9476b_elex_wannacry
- Size 24KB
- SHA256 0680b4651f1c40d8328ea683b711aad09f3bdb97a8564595d5ae27e77b831395
- MD5 5b8dfae4dea239e64d3de19a5da9476b
- SHA1 91856deac0d4e299c4f771ceb2b0ca3e271f7da0
- SHA512 f521b1e72a462606e001b47b32ce342f22df29295497cbcbd107a2d5c302f1a0c92672af8b2665f7d6ad209913e424f227c18a17e6dd42009b83d08a65fb9c93
- SSDEEP 192:oxpice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEBCvu1pFaGSmDaKu:ox1vkaG16eSlBY2ZZfu1OPP
- TLSH
  T142B2E602E6A586A6E210CDB207BB5E3A0935B4771B4556CFA791CF5DB830FC09C22B4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2