phorphiex | d12e10ad82dd514a04260f4a911b53a72e752a45fab714afbbd3840f43695858

General

Target
2026-07-17_8b35d5d8462ac2f6448ab81013f43aac_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 8.8MB
Sample260718-dhw1ssd18k
SHA256 d12e10ad82dd514a04260f4a911b53a72e752a45fab714afbbd3840f43695858
MD5 8b35d5d8462ac2f6448ab81013f43aac
SHA1 fe3a1d5590c7db02e1bc8f68ec737d4d3a178cf0
SHA512 f0455772577926b7801d6cf651e45fb6a4e56d3988a28f6d595b60232aa87d3de079be7887c5d64059c34d6d5787108b4686364a2def725c8c88b4f0a5f405d3
SSDEEP 98304:K9vpD2sDZEMzba6cuj8Yc5qCttMoSzlAlG/Y:2v12sDZEMzG63Z/TM
TLSH
T1BA96E62F17A919ACC5B6B3BED5160F80E13F70440752A7DB179102F52DAEAD88FBB520
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-17_8b35d5d8462ac2f6448ab81013f43aac_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 8.8MB
- SHA256 d12e10ad82dd514a04260f4a911b53a72e752a45fab714afbbd3840f43695858
- MD5 8b35d5d8462ac2f6448ab81013f43aac
- SHA1 fe3a1d5590c7db02e1bc8f68ec737d4d3a178cf0
- SHA512 f0455772577926b7801d6cf651e45fb6a4e56d3988a28f6d595b60232aa87d3de079be7887c5d64059c34d6d5787108b4686364a2def725c8c88b4f0a5f405d3
- SSDEEP 98304:K9vpD2sDZEMzba6cuj8Yc5qCttMoSzlAlG/Y:2v12sDZEMzG63Z/TM
- TLSH
  T1BA96E62F17A919ACC5B6B3BED5160F80E13F70440752A7DB179102F52DAEAD88FBB520
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2