MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 875bbdff1d3a5f2413334cae7041d32158d4557bf6744e09fbdb925068f23e9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Phorpiex

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	875bbdff1d3a5f2413334cae7041d32158d4557bf6744e09fbdb925068f23e9e
SHA3-384 hash:	46e4d7e786d4da70573025545f1c8486d451ac4dce5faf0a15bcc8c796c704c755b56dadcb179f8a3e77a7e73329589a
SHA1 hash:	d972967fc85882c92b2c7a28a4c446754d82329e
MD5 hash:	228475a43ae74067330efd4e72cfd560
humanhash:	seven-alabama-island-table
File name:	getit.exe
Download:	download sample
Signature	Phorpiex Create hunting rule
File size:	11'264 bytes
First seen:	2026-08-18 16:30:43 UTC
Last seen:	2026-08-19 06:11:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d619fbf0a108fb3ff7113afe795582e3 (4 x Phorpiex)
ssdeep	192:mamsGa8mycrcgOPpAhg4CEJJlMLkWScZqGaiPC:OsGa89wOP+hFJMQWSc74
TLSH	T175322A0BAC948112E3F04CB019B1929F47BD69732B6662DFF3B3D64B5B707518520BEA
TrID	39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 8.3% (.EXE) Win64 Executable (generic) (6522/11/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	James_inthe_box
Tags:	exe Phorpiex

Intelligence

File Origin

# of uploads :

# of downloads :

155

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

phorpiex

ID:

File name:

PIC0402023.jpg.zip

Verdict:

Malicious activity

Analysis date:

2026-08-18 16:20:47 UTC

Tags:

susp-lnk arch-exec phorpiex botnet loader

Link:

https://app.any.run/tasks/2e0f20b7-c930-48c3-aa4a-3c6f9d465435

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/81826/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader46-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm crypto downloader evasive microsoft_visual_cc phorpiex

Link:

https://www.filescan.io/uploads/6a8488df3700e6bb2578c0dd/reports/fd3fddf8-ddf4-4258-9b5d-e7d11a9fd7bf/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/875bbdff1d3a5f2413334cae7041d32158d4557bf6744e09fbdb925068f23e9e

Malware family:

Phorpiex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/07353eec-36c9-42ec-85e0-4db7bcf67423

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/875bbdff1d3a5f2413334cae7041d32158d4557bf6744e09fbdb925068f23e9e

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/228475a43ae74067330efd4e72cfd560

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/875bbdff1d3a5f2413334cae7041d32158d4557bf6744e09fbdb925068f23e9e/

Threat name:

Win32.Infostealer.Tinba

Status:

Malicious

First seen:

2026-08-18 16:16:53 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q5n337y5hjpsieztjsxhaqotefmnivl36z2e4cp33ojfa2hsh2pa._file

Verdict:

malicious

Label(s):

Phorpiex

Link:

https://reports.threatray.com/c68cca1a-66a5-4a1f-86e1-4bddbb2ee1bf

Result

Malware family:

phorphiex

Score:

10/10

Tags:

family:phorphiex discovery loader persistence trojan worm

Link:

https://tria.ge/reports/260818-t1lwjswbma/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Adds Run key to start application

Executes dropped EXE

Family: Phorphiex, Phorpiex

Malware Config

C2 Extraction:

http://178.16.54.109

Unpacked files

SH256 hash:

875bbdff1d3a5f2413334cae7041d32158d4557bf6744e09fbdb925068f23e9e

MD5 hash:

228475a43ae74067330efd4e72cfd560

SHA1 hash:

d972967fc85882c92b2c7a28a4c446754d82329e

Link:

https://www.unpac.me/results/a37807f8-3098-4b8e-bf7f-e5025dec07b0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/875bbdff1d3a5f2413334cae7041d32158d4557bf6744e09fbdb925068f23e9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.