ammyyadmin | eb306601326b015b34c62ea9e413d3c13431fe26ab46e236fa6155e6a3ac74cc

General

Target
2026-10-07_3cfdf0df8c78b7c779216e6f9ca4a0ce_elex_hacktools_wannacry
Size 766KB
Sample261007-rpbv4abb68
SHA256 eb306601326b015b34c62ea9e413d3c13431fe26ab46e236fa6155e6a3ac74cc
MD5 3cfdf0df8c78b7c779216e6f9ca4a0ce
SHA1 04897ff2c3856528e5977a2ea2d7544900fa6932
SHA512 13b571b93cde86e63547782b5faaf1a2ac3a8e470a92c2b34a998f920785495cabaad48aa69e9bb8ee240a0f91b6020bc4c517d54f06f7bfdcdb4438769eb6c1
SSDEEP 12288:gX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VEog:6P++ZSlpOUC1KT4+URtYshX5aRlQEYt
TLSH
T189F4AE1239C1807FC1760531CA9A6B75EAF6FE690E768D436388BE2C1E79901DE53738
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-10-07_3cfdf0df8c78b7c779216e6f9ca4a0ce_elex_hacktools_wannacry
- Size 766KB
- SHA256 eb306601326b015b34c62ea9e413d3c13431fe26ab46e236fa6155e6a3ac74cc
- MD5 3cfdf0df8c78b7c779216e6f9ca4a0ce
- SHA1 04897ff2c3856528e5977a2ea2d7544900fa6932
- SHA512 13b571b93cde86e63547782b5faaf1a2ac3a8e470a92c2b34a998f920785495cabaad48aa69e9bb8ee240a0f91b6020bc4c517d54f06f7bfdcdb4438769eb6c1
- SSDEEP 12288:gX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VEog:6P++ZSlpOUC1KT4+URtYshX5aRlQEYt
- TLSH
  T189F4AE1239C1807FC1760531CA9A6B75EAF6FE690E768D436388BE2C1E79901DE53738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2