Extracted

• • Target

    2024-10-09_55ca57c96f10cbfb63d111669c93e6e2_avoslocker_revil

  • Size

    4.6MB

  • MD5

    55ca57c96f10cbfb63d111669c93e6e2

  • SHA1

    24201abececbf2c55acbf1ac3e9b402a259751f2

  • SHA256

    83e93a32bca4d65458218f81f088af7b4dbdce9ef6c231084d2f731b77e7ab30

  • SHA512

    506698a126f26bf7a771d1ec1921a8abab6ffc9b855883f106423d287b5d07b6625d20cbce43a948fc9a091ba5e942c101f2509861cc425951eaaa19ea26680c

  • SSDEEP

    98304:BtuiUQocm9mxVJ/xH2Na7dLa/gaBqPQ61vsxwskCXLRhl3m2drIgIJ9:BNnocm9mxVJ/pUadLaH6Wxwsv1m0URL

  Score

  10^/10

  phorphiexdiscoveryevasionexecutionloaderpersistencespywarestealertrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2