phorphiex | b2408b7904e72e844d73097d33bca6373c704de9f8550654fc2f92c3e86aaa48

General

Target
2026-07-10_9de705870b8357323c28e59784e4f828_akira_cobalt-strike_glassworm_icedid_njrat_vidar
Size 26.8MB
Sample260710-map2yshw2l
SHA256 b2408b7904e72e844d73097d33bca6373c704de9f8550654fc2f92c3e86aaa48
MD5 9de705870b8357323c28e59784e4f828
SHA1 f0c789be89980a41ce6fd734f3cca32e5ae67b03
SHA512 8afa599c169888d63e586e65ee4a33fea553fa201b363c8c21927e8d45bbda89439b579c16bfc0e24114d0485449a6080dbc2a7bafce70ccd35bc9e153e457cf
SSDEEP 786432:4roRDuXVdRhogyZgYeB6kvJkUAQ683JpYJZJ3k6s:4roE3JpYJZJU7
TLSH
T163576C5620A7124CE03EE87C899A7E07D1EA370B07935EDB7580C2B95B9BDED48F9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-10_9de705870b8357323c28e59784e4f828_akira_cobalt-strike_glassworm_icedid_njrat_vidar
- Size 26.8MB
- SHA256 b2408b7904e72e844d73097d33bca6373c704de9f8550654fc2f92c3e86aaa48
- MD5 9de705870b8357323c28e59784e4f828
- SHA1 f0c789be89980a41ce6fd734f3cca32e5ae67b03
- SHA512 8afa599c169888d63e586e65ee4a33fea553fa201b363c8c21927e8d45bbda89439b579c16bfc0e24114d0485449a6080dbc2a7bafce70ccd35bc9e153e457cf
- SSDEEP 786432:4roRDuXVdRhogyZgYeB6kvJkUAQ683JpYJZJ3k6s:4roE3JpYJZJU7
- TLSH
  T163576C5620A7124CE03EE87C899A7E07D1EA370B07935EDB7580C2B95B9BDED48F9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2