Extracted

Extracted

• • Target

    2025-02-09_667ab403af338807fdb0d78031c39a7d_mafia

  • Size

    369KB

  • MD5

    667ab403af338807fdb0d78031c39a7d

  • SHA1

    5febdbda767a2fc5e3098eb410c410f9e84278bf

  • SHA256

    711e2417ade334ffa1ea5d282e29a985a7e9b6e750fc55061e100b3bd7295091

  • SHA512

    218724af9cf42ca813ef239d57a80a0a825ac4b974f90519c19f989c1d6ef9d3b66d489cd3f11cf1ae6e3c8eecb5e9c01306dafb31cf1e6a97e99cf512d4542d

  • SSDEEP

    6144:NVB2/3zlAce21XmClECBwEn7vOH+y/0DL:NVBk3zGcRXFlECB6u

  Score

  10^/10

  phorphiexdefense_evasiondiscoveryexecutionloaderpersistencespywarestealertrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2