Extracted

• • Target

    28068cedfc7c3e3516e39f91ae285ff6f5d26170be34cd69e70fe3f575e203bf.exe

  • Size

    1.2MB

  • MD5

    ad83666a85d2cddceb0ee86c2d8cc621

  • SHA1

    eee45da538bec32eb1d9a9e85dd343fc7f29c185

  • SHA256

    28068cedfc7c3e3516e39f91ae285ff6f5d26170be34cd69e70fe3f575e203bf

  • SHA512

    c3f45a7a3cd605c4d1a887d717c12fa803a42689b1555eec29867d2ac20fac0a7583af5177135b28541efd31fb380c0f95efa708bde6ea10a213251e0a9cd8e9

  • SSDEEP

    24576:D/Xwpqsm3V6Hv9WVrIskLlSQ/lt4xP0DRkOhiVGa:+JmF6Hv9WjkLlSQ/ltSVGa

  Score

  10^/10

  phorphiexdiscoveryevasionexecutionloaderpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2