phorphiex | bf58db870ccf17802980e4c3203b9b2da9e83c613a93cdcf529d3cd82d30cc59

General

Target
2026-07-10_be44127d3f56a78aae793c13b08e074c_cobalt-strike_icedid_luca-stealer_njrat
Size 249KB
Sample260710-jyzdrafx2r
SHA256 bf58db870ccf17802980e4c3203b9b2da9e83c613a93cdcf529d3cd82d30cc59
MD5 be44127d3f56a78aae793c13b08e074c
SHA1 0be4fe1c21b583598940a567b9b4038cfbbc31b6
SHA512 c995f8bdc8c9e3cfaa39c74ef7a159bf9e4761fff35c8cea2480cbfd2f87cc80bc521d8518dae0a9da2e8d6f94b91285e793ae8101eede730b6af95f8e3797aa
SSDEEP 3072:x7UuNfXxhrauZnBzNuy5pCkTZcpPSUyDOy+3GHc5KbuAs0FNmhMn+IhNQ/mr6pea:xJfxhWuHtQUZcpq+4IvYl9a
TLSH
T1E7443947729A51E4D072813487734BE2AB3D7D215791C68F17907B669E3E2C0FE2AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-10_be44127d3f56a78aae793c13b08e074c_cobalt-strike_icedid_luca-stealer_njrat
- Size 249KB
- SHA256 bf58db870ccf17802980e4c3203b9b2da9e83c613a93cdcf529d3cd82d30cc59
- MD5 be44127d3f56a78aae793c13b08e074c
- SHA1 0be4fe1c21b583598940a567b9b4038cfbbc31b6
- SHA512 c995f8bdc8c9e3cfaa39c74ef7a159bf9e4761fff35c8cea2480cbfd2f87cc80bc521d8518dae0a9da2e8d6f94b91285e793ae8101eede730b6af95f8e3797aa
- SSDEEP 3072:x7UuNfXxhrauZnBzNuy5pCkTZcpPSUyDOy+3GHc5KbuAs0FNmhMn+IhNQ/mr6pea:xJfxhWuHtQUZcpq+4IvYl9a
- TLSH
  T1E7443947729A51E4D072813487734BE2AB3D7D215791C68F17907B669E3E2C0FE2AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2