phorphiex | a4fb1599c82adf4f586ffad5ee353e7d2d6301f38642ad11fdcee76dc9b5dfd3

General

Target
xa4fb1599c82adf4f586ffad5ee353e7d2d6301f38642ad11fdcee76dc9b5dfd3.exe
Size 461KB
Sample260528-maxf2acx7q
SHA256 a4fb1599c82adf4f586ffad5ee353e7d2d6301f38642ad11fdcee76dc9b5dfd3
MD5 8253b8070479f5573c4a992d4683a9f3
SHA1 55160a6ef39256c18f5d988645ba81d06cbccd36
SHA512 d050d563c58c3913da4b60d38d3ddf99f1db98bbcf3f60bf6f295a1543f5f32789e148d34ae90b99cc0cb356e332138a7018cd5b1bf83c7d514f53e5ea79fa7f
SSDEEP 6144:1v9/qzrnuGXBCzraOjHElFnRdOsNtns8ciWPbDm6N9RF:1g49H61RgsNtbAd
TLSH
T115A40902B7E99134F2F31B31AFB592655A7ABD629D35C60F23C41A0D0DB0980EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  xa4fb1599c82adf4f586ffad5ee353e7d2d6301f38642ad11fdcee76dc9b5dfd3.exe
- Size 461KB
- SHA256 a4fb1599c82adf4f586ffad5ee353e7d2d6301f38642ad11fdcee76dc9b5dfd3
- MD5 8253b8070479f5573c4a992d4683a9f3
- SHA1 55160a6ef39256c18f5d988645ba81d06cbccd36
- SHA512 d050d563c58c3913da4b60d38d3ddf99f1db98bbcf3f60bf6f295a1543f5f32789e148d34ae90b99cc0cb356e332138a7018cd5b1bf83c7d514f53e5ea79fa7f
- SSDEEP 6144:1v9/qzrnuGXBCzraOjHElFnRdOsNtns8ciWPbDm6N9RF:1g49H61RgsNtbAd
- TLSH
  T115A40902B7E99134F2F31B31AFB592655A7ABD629D35C60F23C41A0D0DB0980EA75B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2