MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Phorpiex

Vendor detections: 15

Intelligence 15 IOCs YARA 3 File information Comments

SHA256 hash:	bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c
SHA3-384 hash:	87cedc670ef86880ac04a2cacf919d3367c2d45ca4393b653d39aeeb8c3f87707d9a580c3321d3c87631391072b5ddf2
SHA1 hash:	894cb271211c3764ea25c1a994629ce6e4e9a462
MD5 hash:	0e9bc9252b008a09e4898681fb9d5a36
humanhash:	violet-july-connecticut-ack
File name:	file
Download:	download sample
Signature	Phorpiex Create hunting rule
File size:	22'528 bytes
First seen:	2026-04-13 17:18:23 UTC
Last seen:	2026-07-24 14:24:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d0f945da54f20d8bcaf079f2d6ea9f63 (9 x Phorpiex)
ssdeep	384:Ou1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:ONuPf4/IUrqY+xsN
Threatray	126 similar samples on MalwareBazaar
TLSH	T115A20805AA56534AF4B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A
TrID	34.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 13.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 13.7% (.EXE) Win64 Executable (generic) (6522/11/2) 10.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-phorpiex exe Phorpiex

Bitsight

url: http://178.16.54.109/peinf.exe

Intelligence

File Origin

# of uploads :

104'271

# of downloads :

192

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

file.exe

Verdict:

No threats detected

Analysis date:

2026-04-13 17:21:25 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/43735d7f-6858-4e3e-9306-8cfbe871c8b3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/61420/

Detection(s):

Win.Ransomware.Phorpiex-10059719-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69dd2573f68adfe100397789

Tags:

shellcode phorpiex trojan blic

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Changing an executable file

Changing a file

Infecting executable files

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm explorer lolbin microsoft_visual_cc phorpiex ransomware

Link:

https://www.filescan.io/uploads/69dd256c5ea31bc68a26d662/reports/332fe1cf-9c66-43c2-9137-647c07b6d117/overview

Verdict:

Malicious

Labled as:

Worm.Phorpiex.Generic

Link:

https://www.hybrid-analysis.com/sample/bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-04-13T14:28:00Z UTC

Last seen:

2026-04-15T15:44:00Z UTC

Hits:

~100

Detections:

HEUR:Virus.Win32.Zeropi.gen

Link:

https://opentip.kaspersky.com/bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c/results?tab=lookup

Malware family:

Phorpiex

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f1deb902-c95d-4609-9621-1324a1765330

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c

Gathering data

Detection:

phorpiex

Link:

https://mwdb.cert.pl/sample/bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c/

Verdict:

Malicious

Threat:

Family.PHORPHIEX

Link:

https://tip.neiki.dev/file/bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c

Threat name:

Win32.Worm.Phorpiex

Status:

Malicious

First seen:

2026-04-13 17:18:57 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

29 of 38 (76.32%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xtk33tjeaah53vofcjqjnev5wyrariojyyebzph5bdkt5ilrqjga._file

Verdict:

malicious

Label(s):

phorpiex

Phorpiex

2e354b69276617989d1b001094fc0d63473fa0d05900cd73d25e17779f82b5f1

Phorpiex

4e6463620c3c1a001e7fb411bbfd7ca9f2b5bdffe0a84bb964b6fd5406bb232a

Phorpiex

c26af9d1c5e023ded48bc29ef612f58fb21f7a709ca4a6a03fb38b3c7c67691f

Phorpiex

error

Phorpiex

+ 116 additional samples on MalwareBazaar

Result

Malware family:

phorphiex

Score:

10/10

Tags:

family:phorphiex discovery loader spyware stealer trojan worm

Link:

https://tria.ge/reports/260413-vvkxqsgt71/

Behaviour

System Location Discovery: System Language Discovery

Reads user/profile data of web browsers

Malware Config

C2 Extraction:

178.16.54.109

Unpacked files

SH256 hash:

bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c

MD5 hash:

0e9bc9252b008a09e4898681fb9d5a36

SHA1 hash:

894cb271211c3764ea25c1a994629ce6e4e9a462

Link:

https://www.unpac.me/results/a4ca6b4d-fbf9-462d-90e6-07c4603d04c3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.