MALICIOUS — 2fed5d0552cf80eaae1928150238397a632ebb9521e98129daa71eb46ea1f113.exe

MALICIOUS — 2fed5d0552cf80eaae1928150238397a632ebb9521e98129daa71eb46ea1f113.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Phorpiex family. 4 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2fed5d0552cf80eaae1928150238397a632ebb9521e98129daa71eb46ea1f113
SHA-1: ffbe00b65889aa4554fb6aef8cac9383652dae6e
MD5: 2e11f99e1017209acc1ecd207f1c5832
imphash: 42cf01d41ef6dc0627982490afc9cddd
ssdeep: 96:2KedvoJYz/J4hSWKB2dS6BDrVx+ZQSlctTKzsg9PFJxGE9mZ2FFhxC7tCEKAYv/:2K6oiEKBEx+eSlRPFJxTEZmFhSKtV
TLSH: T15B23D81BD710A54BDFF28D8B14848D4CB2639BBD656E260A4129D37A0CF1CA7FC1492A
Submitted as: 2fed5d0552cf80eaae1928150238397a632ebb9521e98129daa71eb46ea1f113.exe
File type: pe · Size: 10752 bytes
Verdict: malicious (100/100) · Family: Phorpiex

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (4 of 53 engines)

Hash: abuse.ch ThreatFox: known-malicious-hash
Microsoft Defender: Trojan:Win32/Phorpiex.APX!MTB
Emsisoft (Emergency Kit): Gen:Variant.Worm.Phorpiex.153
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7880) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Phorpiex.APX!MTB (rule Trojan:Win32/Phorpiex.APX!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Worm.Phorpiex.153 (rule Gen:Variant.Worm.Phorpiex.153) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Embedded network infrastructure: http://178.16.54.109/xmr.exe, http://178.16.54.109/xmrget.exe, http://178.16.54.109/8.exe - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

314 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://178.16.54.109/xmr.exe
http://178.16.54.109/xmrget.exe
http://178.16.54.109/8.exe
http://178.16.54.109/7.exe
http://178.16.54.109/6.exe
http://178.16.54.109/5.exe
http://178.16.54.109/4.exe
http://178.16.54.109/3.exe
http://178.16.54.109/2.exe
http://178.16.54.109/1.exe

Embedded domains

staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.cloud.microsoft
searchapp.bundleassets.example
www.msftconnecttest.com
outlook.office.com
outlook.office365.com
www.bing.com
config.edge.skype.com
aps.prod.windows.com
tas02.sls.update.microsoft.com
dns.msftncsi.com
settings-win.data.microsoft.com
to-do.microsoft.com
ctldl.windowsupdate.com
staging.to-do.microsoft.com
edge.microsoft.com
teams.microsoft.com
watson.events.data.microsoft.com
ecs.office.com
g.live.com
fs.microsoft.com
self.events.data.microsoft.com
www.msftncsi.com
msedge.api.cdp.microsoft.com

Embedded IP addresses

178.16.54.109

More Phorpiex samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report