Extracted

• • Target
    D4BBC125A9E94DE44F4DEEA9D6B10ADC87A1EC1AEDD753B39D26BB15817FDADB
  • Size 107KB
  • SHA256 d4bbc125a9e94de44f4deea9d6b10adc87a1ec1aedd753b39d26bb15817fdadb
  • MD5 f437204b3e1627d8b03eefdf360281ad
  • SHA1 c824e787a9786d5fdd19effdec54abef217e5b39
  • SHA512 bdb6fc7d1e7f61df6a7ff3036fd56793e1096937fb07fbe033692f20de1bc81ca0215c5eff5a21627607c1ca514296d9598490c244bba5ec60c74653e1978910
  • SSDEEP 1536:HBlri9Fmav82fMJsznUMPcPfNthq4HC1xaQaQG9MFiL3:hp7O3MizVGlt7SZFiL3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phorphiexdiscoveryevasionexecutionloaderpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2