Extracted

Extracted

• • Target

    ea8206a1499040130f6c075be720c5742aaa770dfaa4b1a59642de82c9cc4792

  • Size

    58KB

  • MD5

    a62d2e705d1a32b0829ade8fde56cf98

  • SHA1

    0f0ff6b268c07ced1b4988fb531251286621c711

  • SHA256

    ea8206a1499040130f6c075be720c5742aaa770dfaa4b1a59642de82c9cc4792

  • SHA512

    8cd6d582acacac27352573916bc5f14f035579495377f5858f5d87a16c755047a0ea89aeaaed3b2ae27c97ba8fc48775c394e1492a0da0ff6fa6312476d18c29

  • SSDEEP

    768:M/05iRcdYFtVM1qUQuvc9HzSHUSUuOOXv8s3i6E5nXfUWPYfIc/Qi3qEBQpfCMP:M88OoVM1q8ewf1OO53i6EBXlLOUp6M

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencespywarestealertrojanwormdefense_evasionexecution

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2