MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83723bbe3d6116bdc45de533d7c890ab627bc18531d2c19d0d199e5151627fd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Phorphiex

Vendor detections: 13

Intelligence 13 IOCs YARA 6 File information Comments

SHA256 hash:	83723bbe3d6116bdc45de533d7c890ab627bc18531d2c19d0d199e5151627fd2
SHA3-384 hash:	76560c84f0a659c8eabc2585a004e619cda86fab26ae2ecdba82fc1f70b2d05ccf704bd4f7e19a5cfd61b9e497040884
SHA1 hash:	bd63550dd0a27ee22f3abd12e1d1a5bd782eecb5
MD5 hash:	706e4e3277a565232ca3c363299b032f
humanhash:	march-johnny-twelve-finch
File name:	file
Download:	download sample
Signature	Phorphiex Create hunting rule
File size:	15'872 bytes
First seen:	2026-07-28 15:20:36 UTC
Last seen:	2026-07-28 23:42:03 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3537f9c463b968f2d94efe8dfe27133f (34 x Phorpiex, 3 x Phorphiex)
ssdeep	192:AWisGnjXgjk8LcRI+AxOsMhofpF5oIV5ixBKUSf0zQA8FuixgJxTmv8U9cth+N9X:ArScx6fproKn0t8Etav8U9c+nX
TLSH	T136623B0BB8808036EBE04475827F526649FEACB623D0F8D7FBA068C959B46D1F43516F
TrID	34.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 13.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 13.7% (.EXE) Win64 Executable (generic) (6522/11/2) 10.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-phorpiex exe Phorphiex

Bitsight

url: http://178.16.54.109/11.exe

Intelligence

File Origin

# of uploads :

# of downloads :

192

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/76571/

Detection(s):

Win.Dropper.Phorpiex-10008698-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Connecting to a non-recommended domain

Launching a service

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug crypto dropper evasive fingerprint microsoft_visual_cc phorpiex xor-url xor-url

Link:

https://www.filescan.io/uploads/6a68c8cde43341492ffd5ac5/reports/491b38ff-73ea-4f2d-bb84-8944b45c9e95/overview

Verdict:

Malicious

Labled as:

Mint.Zard.Generic

Link:

https://www.hybrid-analysis.com/sample/83723bbe3d6116bdc45de533d7c890ab627bc18531d2c19d0d199e5151627fd2

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-07-28T11:07:00Z UTC

Last seen:

2026-07-30T13:26:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/83723bbe3d6116bdc45de533d7c890ab627bc18531d2c19d0d199e5151627fd2/results?tab=lookup

Malware family:

Phorpiex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/33053703-6505-426c-b48a-6bdcdfbd8a31

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/83723bbe3d6116bdc45de533d7c890ab627bc18531d2c19d0d199e5151627fd2

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/706e4e3277a565232ca3c363299b032f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/83723bbe3d6116bdc45de533d7c890ab627bc18531d2c19d0d199e5151627fd2/

Threat name:

Win32.Worm.Phorpiex

Status:

Malicious

First seen:

2026-07-28 13:56:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qnzdxpr5mell3rc54uz5pseqvnrhxqmfghjmdhindgpfculcp7ja._file

Verdict:

malicious

Label(s):

Phorpiex

Link:

https://reports.threatray.com/1e45682c-6948-4d13-bf84-b1dfa2d9f23b

Result

Malware family:

phorphiex

Score:

10/10

Tags:

family:phorphiex discovery loader trojan worm

Link:

https://tria.ge/reports/260728-sq6yasygka/

Behaviour

System Location Discovery: System Language Discovery

Malware Config

C2 Extraction:

http://178.16.55.240/nmixx_/

Unpacked files

SH256 hash:

83723bbe3d6116bdc45de533d7c890ab627bc18531d2c19d0d199e5151627fd2

MD5 hash:

706e4e3277a565232ca3c363299b032f

SHA1 hash:

bd63550dd0a27ee22f3abd12e1d1a5bd782eecb5

Link:

https://www.unpac.me/results/585d88f9-7b6a-4a51-80ea-16456e76b412/

Malware family:

Phorpiex

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/83723bbe3d61/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/83723bbe3d6116bdc45de533d7c890ab627bc18531d2c19d0d199e5151627fd2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	without_attachments Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any attachment
Reference:	http://laboratorio.blogs.hispasec.com/

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/