MALICIOUS — 1ccfd6555390617b416bed0bd48ef3edba47bf042e102f504a2113bc356eeb0f.exe

MALICIOUS — 1ccfd6555390617b416bed0bd48ef3edba47bf042e102f504a2113bc356eeb0f.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Phorpiex family. 3 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1ccfd6555390617b416bed0bd48ef3edba47bf042e102f504a2113bc356eeb0f
SHA-1: f40d13309750622a184b167fc5205fb4f622b45e
MD5: 2de0535c878a7b9a8971f74bb77abb91
imphash: 2447f2446a419d1ace39af3bf9d1286a
ssdeep: 192:pZs5rlB+oOCoFadod/wDl+uFJxT7ShmFhKIb3E:/s5KyooW/wD9FfShO
TLSH: T17225810EA3186605CDB5A797648059BF90D2A3B9AA7A31570D8AC33E8CE7437FC10467
Submitted as: 1ccfd6555390617b416bed0bd48ef3edba47bf042e102f504a2113bc356eeb0f.exe
File type: pe · Size: 13312 bytes
Verdict: malicious (98/100) · Family: Phorpiex

Source: MalwareBazaar · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified

Detections (3 of 52 engines)

Hash: abuse.ch ThreatFox: known-malicious-hash
Microsoft Defender: Trojan:Win32/Phorpiex.RA!MTB
Emsisoft (Emergency Kit): Gen:Variant.Draftor.3932

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Phorpiex.RA!MTB (rule Trojan:Win32/Phorpiex.RA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Draftor.3932 (rule Gen:Variant.Draftor.3932) - engine signal, weight 0.55, confidence 0.85
Contacted 24 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://178.16.54.109/loader_domain.exe, http://178.16.54.109/lb1.exe, http://178.16.54.109/lb2.exe - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

47 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://178.16.54.109/loader_domain.exe
http://178.16.54.109/lb1.exe
http://178.16.54.109/lb2.exe
http://178.16.54.109/lb3.exe
http://178.16.54.109/lb4.exe
http://178.16.54.109/lb5.exe
http://178.16.54.109/lb6.exe
http://178.16.54.109/lb7.exe
http://178.16.54.109/lb8.exe
http://178.16.54.109/lb9.exe
http://178.16.54.109/lb10.exe
http://178.16.54.109/desk.exe
http://178.16.54.109/OUTLOOKFOUND
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786304393&P2=404&P3=2&P4=Zuh6XWLj9fJX3kaP9C8JhKXgaeO%2fjevKUO51cLSeTLcGwhh5QY%2fpTaWX9CQdsWdUN4wgweZrKBQwMhzHyzhubg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

178.16.54.109
4.207.44.64
52.123.252.235
172.215.188.232
52.230.60.54
4.230.171.124
135.232.92.97
74.178.240.61
74.179.77.204
20.42.65.85
135.234.160.244
203.26.79.13
72.153.5.135
135.232.92.34
52.110.12.45
52.110.12.3

File paths

C:\Program

More Phorpiex samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report