Extracted

Extracted

• • Target

    987af46860cda90c671100e2a3e57a1007c16b4e4ba5230fca5d00c0d85392b4N.exe

  • Size

    447KB

  • MD5

    fe7138eebc824bee64052d322a4bb0f0

  • SHA1

    06d7a4e431d4d7b77109e5894f8b8161c9e77668

  • SHA256

    987af46860cda90c671100e2a3e57a1007c16b4e4ba5230fca5d00c0d85392b4

  • SHA512

    3d6e93fff424cb8c5c11f5536a3f19a6437c2002554bfb8708902cb5e4e4765f47c44d3873a089d48638cf1d71809a2e304f20e0fa46297fff26ced936cce7bf

  • SSDEEP

    6144:QLPnZC2bLwAMEDMrHDxn1pyvGp3wCat3SluW3DMSHMRdpwWDYql4qRFT5P5G:Q7nZ1fgrjBryvlSlu4M/0Wsqlbx

  Score

  10^/10

  phorphiexxmrigdiscoveryexecutionloaderminerpersistencespywarestealertrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2