Extracted

• • Target

    16f57fec906660d12fd7350d48b339c852379a22c1a7117de9573b5b44a38bad

  • Size

    2.4MB

  • MD5

    41e482cd92834fac4e45c9de44102785

  • SHA1

    653a00ed747400d9dd0c8f362048a75ccef3b8c7

  • SHA256

    16f57fec906660d12fd7350d48b339c852379a22c1a7117de9573b5b44a38bad

  • SHA512

    70a123939478276908843acec2d6d30f7255e57eebab7f1de00bffd389abd304eb6237fd94a92d538e55c4ded0935bcd81aab24cbc332a397b833c32aad9ee46

  • SSDEEP

    24576:RnAnKcqafbuHDZS2Xqbzsbx+80kL1y4/pCb9vEYhqKDhQBz8NA66W8MX:mn7fq1SfzIx+4JdWEim8ALWXX

  Score

  10^/10

  phorphiexevasionloaderpersistencetrojanupxworm

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX dump on OEP (original entry point)

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2