Extracted

Extracted

• • Target

    Downloader.exe

  • Size

    202KB

  • MD5

    fca21eb23c210b8ed73302745ea78f70

  • SHA1

    143486e415dedb630de5c776beb3c8b150dd9bf1

  • SHA256

    33a9357923338bee03659341ec7705dc76a2e03245f084311fa758e94c74c3f0

  • SHA512

    41e8c5a6a5b77b6da39a4801494dc83a26dd5010482d907a35a15e51472fcf8c4c4367532c578660760144a39326b6a4f38973a3bd9c43d8f75e0141f9c92e40

  • SSDEEP

    3072:NWF1Sss2XaOvu+v7QC2mCAbtoJOBW0rArwrkut57cIrDjy6Hy7GKbY64IrHi:NWF0+XaOvuyycWNrwrk6y70JIr

  Score

  10^/10

  phorphiexxmrigdiscoveryexecutionloaderminerpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2