phorphiex | ed4a580182a9ebdb7c832073a1276a6e084b80c7a8a5ec27f0cfe90d9ffc7061

General

Target
2026-07-11_9003c1f56b7f38b07d33953d26b505ad_amadey_cobalt-strike_elex_smoke-loader
Size 197KB
Sample260711-gjaezaex2w
SHA256 ed4a580182a9ebdb7c832073a1276a6e084b80c7a8a5ec27f0cfe90d9ffc7061
MD5 9003c1f56b7f38b07d33953d26b505ad
SHA1 0af356036f7f4a8d3e803b22f62b5f757da17154
SHA512 c2ebf9b3847e26587cac29232fc471adcd3d73c645188a497f7cf6883af3087e7c2becaa7b208c7a834e0c6ef5a3cdfa0cb40d09775a30ce0407b0e67fecf64d
SSDEEP 6144:3qz4ebTew3m6utfDcA5zBNiKUwIuqnSPc51tAOybeaBJ:Bw3m6uVgQBgHuqnSPEjYVBJ
TLSH
T1E5148D00B4D2C872E87215301AF4EF754A7DB9158B64ADEF63940B7D4F307C39636AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-11_9003c1f56b7f38b07d33953d26b505ad_amadey_cobalt-strike_elex_smoke-loader
- Size 197KB
- SHA256 ed4a580182a9ebdb7c832073a1276a6e084b80c7a8a5ec27f0cfe90d9ffc7061
- MD5 9003c1f56b7f38b07d33953d26b505ad
- SHA1 0af356036f7f4a8d3e803b22f62b5f757da17154
- SHA512 c2ebf9b3847e26587cac29232fc471adcd3d73c645188a497f7cf6883af3087e7c2becaa7b208c7a834e0c6ef5a3cdfa0cb40d09775a30ce0407b0e67fecf64d
- SSDEEP 6144:3qz4ebTew3m6utfDcA5zBNiKUwIuqnSPc51tAOybeaBJ:Bw3m6uVgQBgHuqnSPEjYVBJ
- TLSH
  T1E5148D00B4D2C872E87215301AF4EF754A7DB9158B64ADEF63940B7D4F307C39636AAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2