Extracted

• • Target

    2024-07-03_22f730a24d80460e5ea86fef36513bfa_avoslocker_cobalt-strike

  • Size

    126KB

  • MD5

    22f730a24d80460e5ea86fef36513bfa

  • SHA1

    476ff375ea75a3183ecff434d4d46a3cd4fa78c6

  • SHA256

    a4d48a5cabb2918459adcc4bce3d26e6e06dd99b6de760d3603531dd371223fc

  • SHA512

    ea667bc4819fac1789c3748f262951ff29c0dcf44d9ebd4fba89eceaa3272adb227d5455829026ebed63b783c8840dbd55e6c58624656d20f82006e9963d06dd

  • SSDEEP

    3072:D59MHkUtVPvBLBXjKVqxzMM4iGBiysOBC2cTtjpTebk8PC+1zEHaGVYwX:9WVBBmqdghBitFp6J

  Score

  10^/10

  phorphiexevasionloaderpersistencespywarestealertrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2