phorphiex | 3f1d3ad729c01d0130ad1c19ff067839f0551c0aa6803099a6640ff970276a4e

General

Target
2026-06-01_8a6d93660c58d6b84d29386722dcdb3a_elex_rhadamanthys_stop
Size 419KB
Sample260601-ezrcbaev8k
SHA256 3f1d3ad729c01d0130ad1c19ff067839f0551c0aa6803099a6640ff970276a4e
MD5 8a6d93660c58d6b84d29386722dcdb3a
SHA1 735a87b4f844582545261991ad7a6da9851fd367
SHA512 18339f657f77dcb8418dfc5930c2e86cf3f7ce0a0e41882ec66b84545e8cd6eab7a0eb21f5539709ce3673bf6d8e1687bab2911605433147b0586944b4179e37
SSDEEP 6144:A890CA0QawtUrqNUk0BX3h3KuemLqd7C1io0edeuVkHbHnHPAqYvr6yRI:5a0wIk0BX3RKuemGd70ioGuVWW6oI
TLSH
T1DE947C1037D08136F1B329368BBFD724542DB8715F6986CFA388166E5E70AE1EA3071B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-06-01_8a6d93660c58d6b84d29386722dcdb3a_elex_rhadamanthys_stop
- Size 419KB
- SHA256 3f1d3ad729c01d0130ad1c19ff067839f0551c0aa6803099a6640ff970276a4e
- MD5 8a6d93660c58d6b84d29386722dcdb3a
- SHA1 735a87b4f844582545261991ad7a6da9851fd367
- SHA512 18339f657f77dcb8418dfc5930c2e86cf3f7ce0a0e41882ec66b84545e8cd6eab7a0eb21f5539709ce3673bf6d8e1687bab2911605433147b0586944b4179e37
- SSDEEP 6144:A890CA0QawtUrqNUk0BX3h3KuemLqd7C1io0edeuVkHbHnHPAqYvr6yRI:5a0wIk0BX3RKuemGd70ioGuVWW6oI
- TLSH
  T1DE947C1037D08136F1B329368BBFD724542DB8715F6986CFA388166E5E70AE1EA3071B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2