Extracted

• • Target

    4651bf3c26495f0194ead565adf06640N

  • Size

    112KB

  • MD5

    4651bf3c26495f0194ead565adf06640

  • SHA1

    81e8f66c776270edb935c1172bf10234a45cab7b

  • SHA256

    52e466a63f14eaa3de93e7b7c1941cea5d9d2f685a16fe212620a8018590afd0

  • SHA512

    025ad9dc960f26c4fed330911ffd6347bc1066bc0000e8bcfa050e6ae7c2bd3a012a84d80cf81f933b85e858e3fbc084e4d2cbef3d069fc572874b517c50533d

  • SSDEEP

    1536:szc+qmiFmav82Uy6MqAgcc6rC5jyc5FQUG9X3Kr:k9qoOYag5aCd+n3Kr

  Score

  10^/10

  phorphiexdiscoveryevasionexecutionloaderpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2