Extracted

• • Target

    2024-04-10_c1c6c2df10c36dfc85d03e1d95b833f2_ryuk

  • Size

    195KB

  • MD5

    c1c6c2df10c36dfc85d03e1d95b833f2

  • SHA1

    a31e45c338b3d408c83ca83074ededf35fe0a831

  • SHA256

    baa573f6d713c298d0ea60bc46061491703574460f7bad2c25f53812583bef86

  • SHA512

    ac5f9dad5c87ca32025348e860a0ecee8a4832ebf3085840ccd3eba8c2c134b6672730b6be911b222d8473dd6262ca81e47db305568844d3496de2a687623592

  • SSDEEP

    3072:hSf9QqTjhSp29ZPLoFrn7CdIEwCh0RP+LrzyLPwB4Sa6v9ZX0t5xT79VRSVO:hSlNQp2/LoFrnjv7POnyrwB1EtPE0

  Score

  10^/10

  phorphiexevasionloaderpersistencetrojanworm

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2