phorphiex | bf9270f0b2ce4a3595bbcecd1cf5e9c024c95f57d4715f37f23437e20b698673

General

Target
2026-07-20_9401614df87930d223ef4230db53124d_amadey_elex_luca-stealer_lynx_njrat
Size 3.4MB
Sample260720-xt72zscw3m
SHA256 bf9270f0b2ce4a3595bbcecd1cf5e9c024c95f57d4715f37f23437e20b698673
MD5 9401614df87930d223ef4230db53124d
SHA1 6c1a3a4610c439319fd3669af18c1bc6e81b4921
SHA512 43dc29e36c0af7cd61cd5d171d5524c713610de600d7414e3b2215ced406a590a5fb79f71349ac1003cfa0566fb47838005584187520c5137a6f10e1c2da5569
SSDEEP 49152:VdSlqQ+dPkbljU3HlH2VqFu/F/m7tP3nkswB/c5KgGRQq:6qF2V+u/52xjKgs
TLSH
T186F5F962F7520DF2C98340B0CD766B66CB5AEC780BF107B37B32561EA4796C13525B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-20_9401614df87930d223ef4230db53124d_amadey_elex_luca-stealer_lynx_njrat
- Size 3.4MB
- SHA256 bf9270f0b2ce4a3595bbcecd1cf5e9c024c95f57d4715f37f23437e20b698673
- MD5 9401614df87930d223ef4230db53124d
- SHA1 6c1a3a4610c439319fd3669af18c1bc6e81b4921
- SHA512 43dc29e36c0af7cd61cd5d171d5524c713610de600d7414e3b2215ced406a590a5fb79f71349ac1003cfa0566fb47838005584187520c5137a6f10e1c2da5569
- SSDEEP 49152:VdSlqQ+dPkbljU3HlH2VqFu/F/m7tP3nkswB/c5KgGRQq:6qF2V+u/52xjKgs
- TLSH
  T186F5F962F7520DF2C98340B0CD766B66CB5AEC780BF107B37B32561EA4796C13525B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2