phorphiex | e21f89c2eb06d57b76df1fbc9f7bf762bff9e2e404cc5d86f036848cba50ff04

General

Target
xe21f89c2eb06d57b76df1fbc9f7bf762bff9e2e404cc5d86f036848cba50ff04.exe
Size 2.9MB
Sample260710-mw2ymsaz6v
SHA256 e21f89c2eb06d57b76df1fbc9f7bf762bff9e2e404cc5d86f036848cba50ff04
MD5 3822803920fb29960d193900002cb4f0
SHA1 4a5c9ed7130eb8e8862dad67c25655d57fc842ce
SHA512 e1b914dd75c0bc07156327d64c0944c2c9f7dae032a7358e1944d8803aba78116946203baa382154d7aa5f4d6a392cde48fbd0c39eab0b2ceac37d0a1a1e0b2b
SSDEEP 49152:Tjno07B3vEfLSru7FziqDP0NQJJykjsVc2ot4+Ej2ED+l3eFqEfQETB8hymR4aG:/7Zu7FYQJJykjsVc2ot4+Ej2ED+l3eFn
TLSH
T164E57C3A669C02A4E17BE27D8ECADE47E662781C0372D6CF05D141980E1BDDC5E7FA21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  xe21f89c2eb06d57b76df1fbc9f7bf762bff9e2e404cc5d86f036848cba50ff04.exe
- Size 2.9MB
- SHA256 e21f89c2eb06d57b76df1fbc9f7bf762bff9e2e404cc5d86f036848cba50ff04
- MD5 3822803920fb29960d193900002cb4f0
- SHA1 4a5c9ed7130eb8e8862dad67c25655d57fc842ce
- SHA512 e1b914dd75c0bc07156327d64c0944c2c9f7dae032a7358e1944d8803aba78116946203baa382154d7aa5f4d6a392cde48fbd0c39eab0b2ceac37d0a1a1e0b2b
- SSDEEP 49152:Tjno07B3vEfLSru7FziqDP0NQJJykjsVc2ot4+Ej2ED+l3eFqEfQETB8hymR4aG:/7Zu7FYQJJykjsVc2ot4+Ej2ED+l3eFn
- TLSH
  T164E57C3A669C02A4E17BE27D8ECADE47E662781C0372D6CF05D141980E1BDDC5E7FA21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2