Extracted

• • Target
    16f57fec906660d12fd7350d48b339c852379a22c1a7117de9573b5b44a38bad
  • Size 2.4MB
  • SHA256 16f57fec906660d12fd7350d48b339c852379a22c1a7117de9573b5b44a38bad
  • MD5 41e482cd92834fac4e45c9de44102785
  • SHA1 653a00ed747400d9dd0c8f362048a75ccef3b8c7
  • SHA512 70a123939478276908843acec2d6d30f7255e57eebab7f1de00bffd389abd304eb6237fd94a92d538e55c4ded0935bcd81aab24cbc332a397b833c32aad9ee46
  • SSDEEP 24576:RnAnKcqafbuHDZS2Xqbzsbx+80kL1y4/pCb9vEYhqKDhQBz8NA66W8MX:mn7fq1SfzIx+4JdWEim8ALWXX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phorphiexevasionloaderpersistencetrojanupxworm

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX dump on OEP (original entry point)

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2