phorphiex | 5312f39a4067320dfc3e9c95a898971f3b9d60fa3baff9a63ae47372526978c3

General

Target
2026-07-20_99b0e53b8286224ee676c00be3564b59_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 379KB
Sample260720-xtgj2ad19y
SHA256 5312f39a4067320dfc3e9c95a898971f3b9d60fa3baff9a63ae47372526978c3
MD5 99b0e53b8286224ee676c00be3564b59
SHA1 70f3b3f3a5a42133f2ced1e0606ee78e1d1c8c01
SHA512 af8afb47ac474bad2861e012fbac65ce64bb72824965bfe32ed04b237bf039046ab1b564c65ff430d57978634ac5c9963f967ee78c76c938659f96413b1624df
SSDEEP 6144:Y8/YAiFEBx22ejJlOoXqL25EddL1PeSuP1MxKTWoMazzRG7JHsqCGIeRq3Y+Vnd:Y8/xiFEBx2vjJkoXqLIEddL1PeSK1MxO
TLSH
T1F0849E127A80D032D8B310300FA5EA756ABEF5306F6159CB63E45D6D9F34AC29B31B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.54.109

Targets

- Target
  2026-07-20_99b0e53b8286224ee676c00be3564b59_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
- Size 379KB
- SHA256 5312f39a4067320dfc3e9c95a898971f3b9d60fa3baff9a63ae47372526978c3
- MD5 99b0e53b8286224ee676c00be3564b59
- SHA1 70f3b3f3a5a42133f2ced1e0606ee78e1d1c8c01
- SHA512 af8afb47ac474bad2861e012fbac65ce64bb72824965bfe32ed04b237bf039046ab1b564c65ff430d57978634ac5c9963f967ee78c76c938659f96413b1624df
- SSDEEP 6144:Y8/YAiFEBx22ejJlOoXqL25EddL1PeSuP1MxKTWoMazzRG7JHsqCGIeRq3Y+Vnd:Y8/xiFEBx2vjJkoXqLIEddL1PeSK1MxO
- TLSH
  T1F0849E127A80D032D8B310300FA5EA756ABEF5306F6159CB63E45D6D9F34AC29B31B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery phorphiex loader trojan worm
- Family: Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Downloads MZ/PE file
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Phorphiex, Phorpiex

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2