phorphiex | 92d56cb5e3096f5ac9c47f50541ff92a12050ec09c8a07ab85c0c7c22d8ed446

General

Target
x92d56cb5e3096f5ac9c47f50541ff92a12050ec09c8a07ab85c0c7c22d8ed446.exe
Size 503KB
Sample260710-l6rd8aas51
SHA256 92d56cb5e3096f5ac9c47f50541ff92a12050ec09c8a07ab85c0c7c22d8ed446
MD5 e66c7d8e7765f687039e2b0a82ae4733
SHA1 afdee64e44557d3f63cc851ea6a2bcec98807ac8
SHA512 ad099b8e83de1f46d9369992fd7c50ef229660a756e889f74762d63fd42d2a4b41dadee71f23014b09b1531016ecf677ce02e9ac5b6e123192ff5c777cb321b2
SSDEEP 6144:vk56AlTY8T16Q7OE93UDLuo3RPzBzza+iCOtZxgy/SZGfJXnIZRo:vkTFI3E93UHRhPzVa+i1tThivo
TLSH
T197B45C009A5F1CAFD493F53C8A21CD4BD5F27C150B6286AB76A06D1A7FB728269353C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  x92d56cb5e3096f5ac9c47f50541ff92a12050ec09c8a07ab85c0c7c22d8ed446.exe
- Size 503KB
- SHA256 92d56cb5e3096f5ac9c47f50541ff92a12050ec09c8a07ab85c0c7c22d8ed446
- MD5 e66c7d8e7765f687039e2b0a82ae4733
- SHA1 afdee64e44557d3f63cc851ea6a2bcec98807ac8
- SHA512 ad099b8e83de1f46d9369992fd7c50ef229660a756e889f74762d63fd42d2a4b41dadee71f23014b09b1531016ecf677ce02e9ac5b6e123192ff5c777cb321b2
- SSDEEP 6144:vk56AlTY8T16Q7OE93UDLuo3RPzBzza+iCOtZxgy/SZGfJXnIZRo:vkTFI3E93UHRhPzVa+i1tThivo
- TLSH
  T197B45C009A5F1CAFD493F53C8A21CD4BD5F27C150B6286AB76A06D1A7FB728269353C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2