Extracted

• • Target

    2365f37e0d91e340406bde62b22554b0N

  • Size

    1.4MB

  • MD5

    2365f37e0d91e340406bde62b22554b0

  • SHA1

    fd456c7754b686946a4fe62c7f475a83f375937c

  • SHA256

    aff7ff1a76bbb3c56a81a48658ce0f5edf79edeebe79d9c112b57f32abe6a939

  • SHA512

    39f9bb660bcc8f68468f2b4618170987bebf2481eef13efac7a1f287ef6a60c010aaa660b5f149e2ca9925d31288f7a9fd6305dcb10d36c1332600abe32fbecd

  • SSDEEP

    24576:3/HvSJAKqT88ArI7m9RSzD+3UuuuybEZf4LgxEEj1Vo4R6a6HT6YsNc:v6APT6r9kluuuybEZf4L9EpVo44n6Ys

  Score

  10^/10

  phorphiexdiscoveryevasionexecutionloaderpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2