Extracted

• • Target

    988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N

  • Size

    1.9MB

  • MD5

    697b87cd42a8364e8abec81646a45b70

  • SHA1

    ab09630560711ab6ea3eab29d855a8f6d7a88107

  • SHA256

    988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5

  • SHA512

    cece9eb76e4dd1ccc77926f31cab5ab0a64e6841bbbc526c7707e4a801ddcd2319f50b61fe3a4839bbe1b641a918ec493d5bd9de6933f76d25af149592cba43f

  • SSDEEP

    49152:LyGa7aZkQu/TR+oaPttRFUWc0CHrQC5x5IvwP1wRFJ1aS:WTmZgV+lP9uWc0CQC5x5IuC1v

  Score

  10^/10

  phorphiexdiscoveryevasionexecutionloaderpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2