phorphiex | 207faabe8ed504aeca05d35ed6f8be30db0216731b5cfd0adecf8e4873640883

General

Target
2026-07-12_1bc6e78c5f35a9c377fbf917512da584_cobalt-strike_icedid_njrat_stealc_vidar
Size 4.4MB
Sample260712-rfqynabs9k
SHA256 207faabe8ed504aeca05d35ed6f8be30db0216731b5cfd0adecf8e4873640883
MD5 1bc6e78c5f35a9c377fbf917512da584
SHA1 d3cca7e85ce3d70c188d085d45eb4da1ed21ab03
SHA512 e9ccdcb20e73f005e04780356bc22c7347cb284ce1d845d6c85a2a96789dd9b6028c3a2872a08508a9cadb93456885d2360d4be7647dcc7b2c59262db51a54bf
SSDEEP 49152:pv0jUAvTbjervp8Sgjxjtm15GfPaOGk2UQ+hFP4ytAR0NT1Tt8HfKa5k8ustirE2:t0Tb21ECOGk2RpKa68ra
TLSH
T1BD261A0A37D80194F1F7A27D89B75A02D6B774550B31C6CF06A0538E2FB3EE589BA361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-12_1bc6e78c5f35a9c377fbf917512da584_cobalt-strike_icedid_njrat_stealc_vidar
- Size 4.4MB
- SHA256 207faabe8ed504aeca05d35ed6f8be30db0216731b5cfd0adecf8e4873640883
- MD5 1bc6e78c5f35a9c377fbf917512da584
- SHA1 d3cca7e85ce3d70c188d085d45eb4da1ed21ab03
- SHA512 e9ccdcb20e73f005e04780356bc22c7347cb284ce1d845d6c85a2a96789dd9b6028c3a2872a08508a9cadb93456885d2360d4be7647dcc7b2c59262db51a54bf
- SSDEEP 49152:pv0jUAvTbjervp8Sgjxjtm15GfPaOGk2UQ+hFP4ytAR0NT1Tt8HfKa5k8ustirE2:t0Tb21ECOGk2RpKa68ra
- TLSH
  T1BD261A0A37D80194F1F7A27D89B75A02D6B774550B31C6CF06A0538E2FB3EE589BA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2