phorphiex | d16df67472f5b281204852a97afb069bcd0de83adbe0a12c61f3df0c00a34d0a

General

Target
2026-07-10_f9a8da6f435630e9e32caca81b0d749e_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 925KB
Sample260710-l151esh16w
SHA256 d16df67472f5b281204852a97afb069bcd0de83adbe0a12c61f3df0c00a34d0a
MD5 f9a8da6f435630e9e32caca81b0d749e
SHA1 f8421b67862b85a8a9e797a81516b384e9c21c1a
SHA512 f09db9dcf0c1d86b23d69070536949e9cd8a5ac8817bb15766c2ba24dceed679b9f6662b554039c9b3f8ac7940080f65f691d5b434ae1eca7e72b38ead3632e9
SSDEEP 24576:V5vG8T+tfIGI9pZcTy0rtKbqiGGC5SYCc:V5vG8uG9pyW0rKg
TLSH
T17615492DE6A801AAE06A9175EC554706E7B37F05137186CB33A0766A1F376E0CF3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-10_f9a8da6f435630e9e32caca81b0d749e_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
- Size 925KB
- SHA256 d16df67472f5b281204852a97afb069bcd0de83adbe0a12c61f3df0c00a34d0a
- MD5 f9a8da6f435630e9e32caca81b0d749e
- SHA1 f8421b67862b85a8a9e797a81516b384e9c21c1a
- SHA512 f09db9dcf0c1d86b23d69070536949e9cd8a5ac8817bb15766c2ba24dceed679b9f6662b554039c9b3f8ac7940080f65f691d5b434ae1eca7e72b38ead3632e9
- SSDEEP 24576:V5vG8T+tfIGI9pZcTy0rtKbqiGGC5SYCc:V5vG8uG9pyW0rKg
- TLSH
  T17615492DE6A801AAE06A9175EC554706E7B37F05137186CB33A0766A1F376E0CF3AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2