Extracted

• • Target

    0549d4e5d930015a66797a046bb931f3266d3a1da327891913b9b04e44c95eeb

  • Size

    28KB

  • MD5

    adb54611fc170de9e86d31181e567db4

  • SHA1

    a0a7a7cff0904b406c4304a3f0e4d1436abf6a5c

  • SHA256

    0549d4e5d930015a66797a046bb931f3266d3a1da327891913b9b04e44c95eeb

  • SHA512

    0ed78e809d51ef88211f275021cbba1e843cba4a22354d4cd95d5b373e3d064eddafcf1b1239acb7064e311736ba67c1eae9800e2120d0764a7a659bd9b1e0f8

  • SSDEEP

    384:j5RIDVmZ6zWTmydlSAw5dTxJjWOav8U9c2yweeeeeeeeWeeeee9MMp8pIP:DYijIAWdr9a0UFTeeeeeeeeWeeeee7P

  Score

  10^/10

  phorphiexxmrigevasionloaderminerpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2