phorphiex | 0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e

General

Target
x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe
Size 16.9MB
Sample260602-cskvvabx3s
SHA256 0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e
MD5 b808925d2763f91931f3dc619bc5bea9
SHA1 aa564c058682b6320c98e435cdb717a300937656
SHA512 6406408602cfc0af9aeff9e86ac66f802e2579b228140411d46545bc432a368fcb7d39a53b9785b6f3cbd80068bac167a96fa640ff0c62fb64bd2c4e8297c3e6
SSDEEP 393216:3uPqAZ1BbIlNyAD1+wgFrorUzu7ypw/IEbngdfiRg6NPLUTkfUrOfj6H/O18r+:eSAhIuApHgOwa+puIEDglzuLUQ762er+
TLSH
T15A073353B3A9C5B3D43B4A3839B9CB6687777C602132DD5B97D02DAE6B303049632726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe
- Size 16.9MB
- SHA256 0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e
- MD5 b808925d2763f91931f3dc619bc5bea9
- SHA1 aa564c058682b6320c98e435cdb717a300937656
- SHA512 6406408602cfc0af9aeff9e86ac66f802e2579b228140411d46545bc432a368fcb7d39a53b9785b6f3cbd80068bac167a96fa640ff0c62fb64bd2c4e8297c3e6
- SSDEEP 393216:3uPqAZ1BbIlNyAD1+wgFrorUzu7ypw/IEbngdfiRg6NPLUTkfUrOfj6H/O18r+:eSAhIuApHgOwa+puIEDglzuLUQ762er+
- TLSH
  T15A073353B3A9C5B3D43B4A3839B9CB6687777C602132DD5B97D02DAE6B303049632726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2