Extracted

• • Target

    7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965

  • Size

    23KB

  • MD5

    086c5d7468ed9d9adaa51be45f619dbf

  • SHA1

    f5ae97308e8b54463165d731131d86c2d7c51abb

  • SHA256

    7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965

  • SHA512

    9a187bdba18913802d108c1ca5bc1e62f9e625bd3e5c0e8348177c3025674e9749ae3ab7c665c8f1829118ff636932e63bad477be0668674d7bfc5b05f89f5cd

  • SSDEEP

    384:fb/260R+KhFPBdPWepb38K+XrIN++7DHMrpGP:TepRpFsp67MQP

  Score

  10^/10

  phorphiexxmrigevasionloaderminerpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2