Extracted

Extracted

• • Target

    71e948bcbd293f58094ef59536b885bb67b0c98d2a25a9d318bbe8dd72dc50bf.exe

  • Size

    304KB

  • MD5

    328d0a2a3ea5c9850e13f499d3e511c7

  • SHA1

    d59d304a91e719e3ce489ea007c5a1e30d3abf74

  • SHA256

    71e948bcbd293f58094ef59536b885bb67b0c98d2a25a9d318bbe8dd72dc50bf

  • SHA512

    9c3782d94c7025119026136937b4de51427dbaaae6442c3474ceac32487fea79dbccdbd5a3607d38401cd6050e73b9a331acd2c02b7e3ff8b56a9d9c2868be55

  • SSDEEP

    6144:yEhYF7KR+Rr0DKwIb8IgUo7xFyAOjqjKSEIt5A6:yYEKRsr0DKLDEyNmKSW6

  Score

  10^/10

  phorphiexdefense_evasiondiscoveryexecutionloaderpersistencespywarestealertrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2