Extracted

• • Target

    2024-04-13_2e6e7151f271ee69a0e122dfd1175932_magniber_revil

  • Size

    17.9MB

  • MD5

    2e6e7151f271ee69a0e122dfd1175932

  • SHA1

    5af8c085ac0426db294a160891995863d1ee1695

  • SHA256

    69b108d3f9ebaad62e3fafa30800257143a134f750ebfbcbc08e2f7e8494ca29

  • SHA512

    f4447fedafbd2818efc0f9e144eb7baf938b2b5679ef9e81150fbbf2c4dc5fadda442aba47c1ba320a93e91fe2624d6c207d9b0346aab2396c6e12abdb90623f

  • SSDEEP

    196608:xPsUq3CvsRTa2egZ/VVZum0KqviM6HrJQfFfxJiJITXsdwn2TIWS2ieUC5L/2R70:xE/3CkDeoKm0cHrJQxxJiKpjJeX8FA

  Score

  10^/10

  phorphiexdiscoveryevasionloaderpersistencetrojanworm

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2