Extracted

Extracted

• • Target

    953425bbd6408fb6ee0b3c9f33d4b1928e1059f0f23eebf7ad57444114816a6dN

  • Size

    177KB

  • MD5

    cf3539efa51b18889e96f7ede3ac2b10

  • SHA1

    dcd9a39a25cac8c0e7a458f8a8581cf8a7673e1c

  • SHA256

    953425bbd6408fb6ee0b3c9f33d4b1928e1059f0f23eebf7ad57444114816a6d

  • SHA512

    3f11087bd431df59840d7d543a7f8534eec51d3982cc3522b3aecf7bb7da13b13ec2a9444c44ff6df8f72618d1c925cdd94734f75859bb1e3044b122ffe888a9

  • SSDEEP

    3072:49qoOaag5aCd+n3KrzhqWZPNlA/NN4DsLUs7cOtzP1yN:4wpaag5xE3K/tlq4DtsoOZtyN

  Score

  10^/10

  phorphiexsalitybackdoordiscoveryevasionexecutionloaderpersistencetrojanupxworm

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2