phorphiex | 82aa62af5a80d3a96f5b5cc39762ec6240c8889423267e2592c56e95393a2dc2

General

Target
2026-07-12_d55a30f1ad49da71fb86ad4395251437_amadey_avoslocker_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_redline-stealer
Size 206KB
Sample260712-tfl1taex4v
SHA256 82aa62af5a80d3a96f5b5cc39762ec6240c8889423267e2592c56e95393a2dc2
MD5 d55a30f1ad49da71fb86ad4395251437
SHA1 72dc88e49226fa87f6616022a79e864fe28f3bcc
SHA512 518ce710e521c03221cb91fa879ec0187bf3808b3174fc0f2b6a9187ad88ce3f157a7c4bd17da9f66fd21bbe5d907f454888b58bc186aa7c961b40e74cc127b2
SSDEEP 3072:nx1ob3RakbGvSWtH05iFtoJeGe3cFmPm2XVC4/VTdJwjbSX3Ih5GHoOAg0FuD0ov:nx1obBakbhc7+4VxrKb43I2AOjWOpo
TLSH
T1C8249D257DC2C433E876143008E4DB79693EB9311B6499FFA3C8477E9E206C19B25A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-12_d55a30f1ad49da71fb86ad4395251437_amadey_avoslocker_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat_redline-stealer
- Size 206KB
- SHA256 82aa62af5a80d3a96f5b5cc39762ec6240c8889423267e2592c56e95393a2dc2
- MD5 d55a30f1ad49da71fb86ad4395251437
- SHA1 72dc88e49226fa87f6616022a79e864fe28f3bcc
- SHA512 518ce710e521c03221cb91fa879ec0187bf3808b3174fc0f2b6a9187ad88ce3f157a7c4bd17da9f66fd21bbe5d907f454888b58bc186aa7c961b40e74cc127b2
- SSDEEP 3072:nx1ob3RakbGvSWtH05iFtoJeGe3cFmPm2XVC4/VTdJwjbSX3Ih5GHoOAg0FuD0ov:nx1obBakbhc7+4VxrKb43I2AOjWOpo
- TLSH
  T1C8249D257DC2C433E876143008E4DB79693EB9311B6499FFA3C8477E9E206C19B25A7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2