Extracted

Extracted

• • Target

    53c9a6fc60f1b68e23f9a4060452d035af7e2eb73fec2f42b6012fc98417115a/53c9a6fc60f1b68e23f9a4060452d035af7e2eb73fec2f42b6012fc98417115a.exe

  • Size

    72KB

  • MD5

    449c0175718415174c3961728c7b48ba

  • SHA1

    573e1558ba736edefc6a41dda6505f07b9eddfd8

  • SHA256

    53c9a6fc60f1b68e23f9a4060452d035af7e2eb73fec2f42b6012fc98417115a

  • SHA512

    423841097e9711322c647735f69a40105ca1a9a5d4245b92d1334909f6fde9d4ef2df195296b929c052022ba677c6705cdea6779f43f3cd767261b5bf9065efe

  • SSDEEP

    1536:Ij2YmZ2WQAZ+4DRkT4Us96osMiq1Mb+KR0Nc8QsJq39:Iq2e1ixoNiue0Nc8QsC9

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit
  behavioral1behavioral2

• • Target

    6fc8b5b8a90cf8ba7e0eb930fcdde776f8eeb3f37913318df7766a365e13fa8e/6fc8b5b8a90cf8ba7e0eb930fcdde776f8eeb3f37913318df7766a365e13fa8e.exe

  • Size

    10KB

  • MD5

    ed9fbbbe548c41479cb70e4d694793d0

  • SHA1

    a0bde162d2241ab2acb58544511a41df30a096a7

  • SHA256

    6fc8b5b8a90cf8ba7e0eb930fcdde776f8eeb3f37913318df7766a365e13fa8e

  • SHA512

    49652367fec13a1e7a188fd039bf8a9fae6be72fdc31e7597bbcfdf30375277f6a7e09b74bd5a2adf1696cf720998c751b7e1671afa3a59c4dfa7069bca543fb

  • SSDEEP

    192:Jd94uPG8E1CDSnzmgp+eMwY46BJxT43thW:394u5SCDSnJo+c83

  Score

  10^/10

  phorphiexxmrigdiscoveryevasionexecutionloaderminerpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral3behavioral4