phorphiex | a2ef1fde5b07f5da1ddcf73aa3dff39908013b1ea983ac4c60283f17242e9e23

General

Target
2026-07-11_20760acaf0e01bc4b27c0a9127a440e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 384KB
Sample260711-hmbymsdv2m
SHA256 a2ef1fde5b07f5da1ddcf73aa3dff39908013b1ea983ac4c60283f17242e9e23
MD5 20760acaf0e01bc4b27c0a9127a440e5
SHA1 0c067001b83b8108bea257fa0790784663ae7cdb
SHA512 9273536cb1cef7bd916ca023355c2c3fc0c6b81b2b15df13e488bcb61ce4324e87e66548359b260f051b1dc2d6f66b025819fdb802b0f15384dad8cc8331ed98
SSDEEP 6144:F4+NkEcl+sT1BSeQgFl/DNEl+tp1afpxf0c5o5TSIM:F4+N/GBSeQgF1REAtp1aff0J5Td
TLSH
T151846C16F6E804F8E067A2388E668903E7767C09077097DF23E446576F275E1AE3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-11_20760acaf0e01bc4b27c0a9127a440e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 384KB
- SHA256 a2ef1fde5b07f5da1ddcf73aa3dff39908013b1ea983ac4c60283f17242e9e23
- MD5 20760acaf0e01bc4b27c0a9127a440e5
- SHA1 0c067001b83b8108bea257fa0790784663ae7cdb
- SHA512 9273536cb1cef7bd916ca023355c2c3fc0c6b81b2b15df13e488bcb61ce4324e87e66548359b260f051b1dc2d6f66b025819fdb802b0f15384dad8cc8331ed98
- SSDEEP 6144:F4+NkEcl+sT1BSeQgFl/DNEl+tp1afpxf0c5o5TSIM:F4+N/GBSeQgF1REAtp1aff0J5Td
- TLSH
  T151846C16F6E804F8E067A2388E668903E7767C09077097DF23E446576F275E1AE3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2