MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Phorpiex


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73
SHA3-384 hash: 7ec9aeb029d5d2c2804e1d86ff2712191c8c5aee83f268cc180744c3805fc792c108a3e27e1a37651f314eac64cd134c
SHA1 hash: 59785eb0f54995c670340a177f481ea72127f4e0
MD5 hash: 5285c03009623a66df99dbc04b5bd1ad
humanhash: hotel-beer-london-cardinal
File name:file
Download: download sample
Signature Phorpiex
Create hunting rule
File size:18'432 bytes
First seen:2026-06-19 16:40:30 UTC
Last seen:2026-07-04 22:16:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash edd9caae8565fbe43a73e0ad530f325e (44 x Phorpiex, 2 x PhantomStealer)
ssdeep 384:LXIqQlV6lvR+v0CvBu9JgwHcOv4av8U9cmF:LD80IE9b4a0U
Threatray 797 similar samples on MalwareBazaar
TLSH T14D825B0FB8424726D0E210B49676977BDABA6872338414DBF7D44AE90B686D5FC3311F
TrID 34.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
13.7% (.EXE) Win64 Executable (generic) (6522/11/2)
10.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-phorpiex exe Phorpiex


Avatar
Bitsight
url: http://178.16.54.109/n.exe

Intelligence

File Origin
# of uploads :
4'640
# of downloads :
165
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73.exe
Verdict:
No threats detected
Analysis date:
2026-06-19 16:41:42 UTC
Tags:
ip-check
Link:
https://app.any.run/tasks/380392a3-4c79-426e-bc7e-575dff091e8d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/71257/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader46.474.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a35710e86bc95245bf7d492
Tags:
phishing dropper smtp remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Connecting to a non-recommended domain
Creating a file in the %temp% directory
Sending a custom TCP request
Query of malicious DNS domain
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug crypto evasive fingerprint microsoft_visual_cc xor-url
Link:
https://www.filescan.io/uploads/6a3571079799578a6c4257ee/reports/37dc4f0a-3065-465b-96ab-a7b505a61ccd/overview
Verdict:
Malicious
Labled as:
Mint.Zard.Generic
Link:
https://www.hybrid-analysis.com/sample/df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-19T13:48:00Z UTC
Last seen:
2026-06-21T14:44:00Z UTC
Hits:
~1000
Detections:
Email-Worm.LovGate.TCP.C&C Trojan.Win32.Wofith.sb Trojan-Spy.Agent.SMTP.C&C Trojan-Dropper.Win32.Phorpiex.sb Trojan-Dropper.Dinwod.HTTP.C&C PDM:Trojan.Win32.Generic HEUR:Email-Worm.Win32.LovGate.gen BSS:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73/results?tab=lookup
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/07618550-cfdf-4237-b7e7-b6927ffd5f17
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/5285c03009623a66df99dbc04b5bd1ad
Detection:
phorpiex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73/
Verdict:
Malicious
Threat:
Family.PHORPHIEX
Link:
https://tip.neiki.dev/file/df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73
Threat name:
Win32.Worm.Phorpiex
Create hunting rule
Status:
Malicious
First seen:
2026-06-19 16:41:43 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=35ec3igzuntfsj4v2h4h6f2ovzveeoyb2tkktr5qelqxyobzlvzq._file
Verdict:
malicious
Label(s):
phorpiex
Create hunting rule
Similar samples:
041341453321adb6bceb73abee88484a28f27f0de1e2916575cdbc197ea839dc
Phorpiex
5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1
Phorpiex
724ec6b8cf5834d429ce360dc4427c8af4b1944cfe99020657f38ebb9b4b9d25
Phorpiex
b221a625be886002e3a18c1302bf5a564d45b706eac539d9d04494cffbedbd95
Phorpiex
bb0a84401c30c261c5e4d2f28b8e9ccea9742c586c254c10625c50a57000eb49
Phorpiex
cbc590012eba8834dd1a984de7b17e92bdf616d06be1f622c42b41ab73844000
Phorpiex
df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73
Phorpiex
ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c
Phorpiex
error
Phorpiex
+ 787 additional samples on MalwareBazaar
Result
Malware family:
phorphiex
Create hunting rule
Score:
  10/10
Tags:
family:phorphiex discovery loader trojan worm
Link:
https://tria.ge/reports/260619-t6v2eahx8p/
Behaviour
System Location Discovery: System Language Discovery
Malware Config
C2 Extraction:
http://178.16.55.240/
Unpacked files
SH256 hash:
df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73
MD5 hash:
5285c03009623a66df99dbc04b5bd1ad
SHA1 hash:
59785eb0f54995c670340a177f481ea72127f4e0
Link:
https://www.unpac.me/results/695779ad-5e9f-4504-806c-1a4719641e51/
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/df482da0d9a3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:test_rule_vldslv
Create hunting rule
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Phorpiex

Executable exe df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73

(this sample)

  
Dropped by
Phorpiex
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/71257/
  
URLhaus
https://urlhaus.abuse.ch/url/3858824/

Comments