Extracted

• • Target
    d8ecc1fd1deb6c69a39bbae5c2c4e528.exe
  • Size 10KB
  • SHA256 4b56d0b0c8c52803bf7c21587bd98a16f73f0d6ed4e4153eee1964533ac394ee
  • MD5 d8ecc1fd1deb6c69a39bbae5c2c4e528
  • SHA1 9abce16698a70cf118a251a00ba550122ad31102
  • SHA512 7c00e5d84b5e6b5b8ac4e9bd1b1490db6cb1888c48f74946cc218954a1be30030360dc1fad35d7cd8e6909c58a0d201111ef8dc5416462378646c8bebc218ab7
  • SSDEEP 192:V8WNyBKkeqbOABDNDZP1oynVeMLkWS+E/Q+VIKiIidEiv:lNyxeqFBl1XeMQWS+E/Q+VXiWiv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phorphiexevasionloaderpersistencetrojanworm

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2