Extracted

• • Target

    2024-04-20_b6770307327887259271737f9aad017c_icedid

  • Size

    6.0MB

  • MD5

    b6770307327887259271737f9aad017c

  • SHA1

    aab47f185cefeacec1295083bb0d09eb915971d5

  • SHA256

    32e0b5516748ad603b6978434668b0185cddb1302719a306d7e15f860d992c23

  • SHA512

    b42a44bef7928dc5d8ea51688325f5804535b2110780bc3cd44ecbd457367abeb33f60b96113ff2cc6ffef7bbf103a45129eb4be88b2cab70c4f0b8d6d1d12c7

  • SSDEEP

    49152:NnZkYptHcOTjThuLrox8wPESJTRjnNVFaSHxD/txUdfXBEkEpRXD1r:hZk4tHeojJzaoxDgdf5EpRzl

  Score

  10^/10

  phorphiexevasionloaderpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2