Extracted

• • Target

    bf5d3703be6aa36e063a2eb1c2153e9ba738356583de30082e7bbd286f3dd11d

  • Size

    119KB

  • MD5

    a872e2cf6bd07133b3d94c2a7e9de88d

  • SHA1

    3df4501e3150b28ad5ddc942433806d2c0981d04

  • SHA256

    bf5d3703be6aa36e063a2eb1c2153e9ba738356583de30082e7bbd286f3dd11d

  • SHA512

    401e9ab11c7dd7f54aa50f7b0c953af001ef2bea8e6c9844d3d8bab23a8fcb10fdc3f9f9110e050634f823a1c772ca48b1d0d58972f4c55a3c04dcf34d7f97ad

  • SSDEEP

    1536:hL0IGzbFmav82XwudF6+0MTqEjXm/D5AKHKKnlN0B9NXrUm7v9lwnINk:90poOfF6+JuEjaaKHKol09N7rAnINk

  Score

  10^/10

  phorphiexloaderpersistencetrojanwormevasion

  • Modifies firewall policy service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2