phorphiex | 6470c839381e8d1c2e17c8ffdfcd04a54bc6c0c8d21a2497b8923dd607346beb

General

Target
2026-07-20_7a99adde274aa8b9e24ce54522cadce5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 380KB
Sample260720-x1mpmaev2t
SHA256 6470c839381e8d1c2e17c8ffdfcd04a54bc6c0c8d21a2497b8923dd607346beb
MD5 7a99adde274aa8b9e24ce54522cadce5
SHA1 4bfb2b1f3169f59e46502c8c6afc66802177d3c1
SHA512 c0879401650fbdfa942e33e54747bf2fa031efb28ec891b3e2d19779f0030c6c4aa8d8e2fa5964ce9df884130a0861429e5ac8015d5428e2185166455fd40e88
SSDEEP 6144:tCtXJZPpiz3yHTEfo3/nDNbgBvoaeCtnXPmaYIpRBz:a5yyHTEfoPD9qvoaeCxPmOpR
TLSH
T1DE847C16F69804F8E0A79238CE668907E7717C09077097DF23E446576F236E1AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-20_7a99adde274aa8b9e24ce54522cadce5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 380KB
- SHA256 6470c839381e8d1c2e17c8ffdfcd04a54bc6c0c8d21a2497b8923dd607346beb
- MD5 7a99adde274aa8b9e24ce54522cadce5
- SHA1 4bfb2b1f3169f59e46502c8c6afc66802177d3c1
- SHA512 c0879401650fbdfa942e33e54747bf2fa031efb28ec891b3e2d19779f0030c6c4aa8d8e2fa5964ce9df884130a0861429e5ac8015d5428e2185166455fd40e88
- SSDEEP 6144:tCtXJZPpiz3yHTEfo3/nDNbgBvoaeCtnXPmaYIpRBz:a5yyHTEfoPD9qvoaeCxPmOpR
- TLSH
  T1DE847C16F69804F8E0A79238CE668907E7717C09077097DF23E446576F236E1AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2