Extracted

• • Target
    NEAS.db925598a39d9f07c76b679b13095e80.exe
  • Size 1.6MB
  • SHA256 85dad1af725eba916e1568cc4709bb6f2c3050108cc2563698b4ab4d158d71a1
  • MD5 db925598a39d9f07c76b679b13095e80
  • SHA1 961aff21c1e5e6d3d73b25ec055b9bdadc794b07
  • SHA512 6fe012f38f0ca7eb0744ed0f5eaf615f389dbfb4ee5b8c40fed9b19ef0bd99659217961422de49c1ffa6f519ba61ea63922693b499a7981612189d5adb162529
  • SSDEEP 24576:mLILY8Xu/3y8UsG2BgYLicwnklCHdebUKyZURQ1TgjTs:xYrC8UsGuTwkCHdeQKyZURQ1EjTs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phorphiexevasionloaderpersistencetrojanworm

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2