phorphiex | 2365a4ec113dbfc80318999f95f1b4081c764610d548a4916b9b198eebd504d8

General

Target
2026-07-08_7d168b49a6941eeb85d1cda7af291b5d_cobalt-strike_hijackloader_icedid_njrat_vidar
Size 803KB
Sample260708-3st2mabv91
SHA256 2365a4ec113dbfc80318999f95f1b4081c764610d548a4916b9b198eebd504d8
MD5 7d168b49a6941eeb85d1cda7af291b5d
SHA1 0436d437eac16c29f92010c68176b3abb991b938
SHA512 1b1cd2f8a8914402885368f381c7c973446464c6c4836d18ce5d7b04c807983dfd41231a2ee6eeeccf3403620257e288d749b1343877947f35a128251f8cd917
SSDEEP 24576:aSJGG42fHhGvJiKEZna/7PYYYYYYkYYYhYYYYYYYYYYYYfYYYYrYYYiXZ9H2F0Ua:axG42fBGsKjjXdUK
TLSH
T16205AE96F7B847F5D167C13889628656F776785507309BDF12A0833E2F23AE21E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-08_7d168b49a6941eeb85d1cda7af291b5d_cobalt-strike_hijackloader_icedid_njrat_vidar
- Size 803KB
- SHA256 2365a4ec113dbfc80318999f95f1b4081c764610d548a4916b9b198eebd504d8
- MD5 7d168b49a6941eeb85d1cda7af291b5d
- SHA1 0436d437eac16c29f92010c68176b3abb991b938
- SHA512 1b1cd2f8a8914402885368f381c7c973446464c6c4836d18ce5d7b04c807983dfd41231a2ee6eeeccf3403620257e288d749b1343877947f35a128251f8cd917
- SSDEEP 24576:aSJGG42fHhGvJiKEZna/7PYYYYYYkYYYhYYYYYYYYYYYYfYYYYrYYYiXZ9H2F0Ua:axG42fBGsKjjXdUK
- TLSH
  T16205AE96F7B847F5D167C13889628656F776785507309BDF12A0833E2F23AE21E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2