Extracted

• • Target

    2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk

  • Size

    2.1MB

  • MD5

    ca22db896e169195523be246ee685e4d

  • SHA1

    c7f399c2314dbd81da4a6ce5ec7875181bad7e5f

  • SHA256

    9106395ddc362fe7b169d97eb7266c85e91b9d1c1934e27e2ea06ac8fa947e2d

  • SHA512

    180b91fd83c496dd4f63a1b60e07daea50fa84b5ca56ff1b4848c45603870fa70ba6d32458a24a3d03a1120ee0e72013a703a941ea2723b8270f76cf3b4323ce

  • SSDEEP

    24576:TxSXu0frXd2agL9T+YEt5RFgbBbx97z7fIoggWD:TxSe0zXUagBTpEHRqbBvz7Rg

  Score

  10^/10

  phorphiexdiscoveryevasionexecutionloaderpersistencespywarestealertrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2