phorphiex | spm[.]exe

Resubmissions

23/09/2026, 22:49

260923-2r2jmsfc7610

23/09/2026, 22:46

260923-2p3zpafc2310

Sharing

Copy URL Twitter E-mail

General

Target
spm.exe
Size 18KB
Sample260923-2r2jmsfc76
SHA256 a3ba0f671df55e1515a13ab81946ac13deb8241fa2f4d9f2a7a6ab2cca26053e
MD5 2fbb8a3529eab1d6b0e870f214a10f64
SHA1 fe56bfcba779f43ec30c21ca9d5f20bf18cc2c88
SHA512 157a85cdebb9670db37db9a1908035bf2ba1438d0c9a6f6a1cd5e576fc12fdd3317a51678b9c7c1225c203e88438989055d2a22a90f1c12ca965ab8ff9f27c64
SSDEEP 384:016I8vVaF6OeYUQQlmLu94gXTczlmxav8U9czl:01PvUQQt9U8a0U
TLSH
T118824B0FB9424326D0E11070A676467BDA79A8B637C414DBF7E48AEE0A6C6D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm trojan loader phorphiex

Malware Config

Extracted

Family

phorphiex

http://178.16.54.109/spm/

Mutex

sfsff

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36

Signatures

Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spm.exe

File Explorer

spm.exe

.exe 18KB

spm.exe

IMPHASH edd9caae8565fbe43a73e0ad530f325e
SHA256 a3ba0f671df55e1515a13ab81946ac13deb8241fa2f4d9f2a7a6ab2cca26053e
MD5 2fbb8a3529eab1d6b0e870f214a10f64
SHA1 fe56bfcba779f43ec30c21ca9d5f20bf18cc2c88
SHA512 157a85cdebb9670db37db9a1908035bf2ba1438d0c9a6f6a1cd5e576fc12fdd3317a51678b9c7c1225c203e88438989055d2a22a90f1c12ca965ab8ff9f27c64
SSDEEP 384:016I8vVaF6OeYUQQlmLu94gXTczlmxav8U9czl:01PvUQQt9U8a0U
TLSH
T118824B0FB9424326D0E11070A676467BDA79A8B637C414DBF7E48AEE0A6C6D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11015

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcr90

_unlock __dllonexit _lock _onexit ?terminate@@YAXXZ _except_handler4_common _invoke_watson _controlfp_s _crt_debugger_hook __set_app_type _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln exit _ismbblead _XcptFilter _exit _cexit __getmainargs _amsg_exit mbstowcs atoi _wfopen fgets fclose strtok strchr strcpy strcat memset strstr srand sprintf strlen _decode_pointer rand

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetOpenUrlW InternetOpenW InternetReadFile

shlwapi

StrStrA StrCmpNA PathFileExistsW

ws2_32

recv select htons gethostbyname inet_addr connect socket closesocket setsockopt shutdown WSAStartup send

dnsapi

DnsQuery_A DnsFree

kernel32

GetTickCount lstrlenA GetTimeZoneInformation FileTimeToSystemTime FileTimeToLocalFileTime ExitThread ExitProcess DeleteFileW CreateThread ExpandEnvironmentStringsW GetModuleFileNameW GetLastError CreateMutexA InterlockedExchange InterlockedCompareExchange GetStartupInfoA SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentThreadId Sleep CloseHandle WriteFile CreateFileW GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetLocalTime

user32

wsprintfA wsprintfW