phorphiex | a12412e1c4c2ec8739a243be2e475bd5107c0227802492c5314d5238d652a380

General

Target
2026-07-15_fc474105660829eccc1418b681755f09_elex_maze_rhadamanthys_stop
Size 681KB
Sample260715-b4d11aby3v
SHA256 a12412e1c4c2ec8739a243be2e475bd5107c0227802492c5314d5238d652a380
MD5 fc474105660829eccc1418b681755f09
SHA1 69aa0da5d1688470f96d518fa25b449261cdb3f6
SHA512 e181036bd4c0d1abe76375ad5c0e0dcc7838340c60b166a8b2c3921853be2fbbc89f8b4e45f0ab0d506d2b2f068d2a06e253facf3fdbc365c5b469079cdddc61
SSDEEP 6144:oFjyi3kuPCaqPj0FiFKXPi3xjI/3dWsR4CmaXjEAEtKs:Ayi3DdqrwiFKXPi3odrOCmaXjEAEtK
TLSH
T1D6E448016698BDA7C432163987B7CBE0977DFD209BA4C6CB36E47749953E0D23A32352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-15_fc474105660829eccc1418b681755f09_elex_maze_rhadamanthys_stop
- Size 681KB
- SHA256 a12412e1c4c2ec8739a243be2e475bd5107c0227802492c5314d5238d652a380
- MD5 fc474105660829eccc1418b681755f09
- SHA1 69aa0da5d1688470f96d518fa25b449261cdb3f6
- SHA512 e181036bd4c0d1abe76375ad5c0e0dcc7838340c60b166a8b2c3921853be2fbbc89f8b4e45f0ab0d506d2b2f068d2a06e253facf3fdbc365c5b469079cdddc61
- SSDEEP 6144:oFjyi3kuPCaqPj0FiFKXPi3xjI/3dWsR4CmaXjEAEtKs:Ayi3DdqrwiFKXPi3odrOCmaXjEAEtK
- TLSH
  T1D6E448016698BDA7C432163987B7CBE0977DFD209BA4C6CB36E47749953E0D23A32352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2