Extracted

Extracted

• • Target

    50e06af7f8a6c59fb96a0ebdbb1256198c7bfae15ed450f6515e3ba3671655c2N.exe

  • Size

    148KB

  • MD5

    98b6c8f99087bd7b7c032259ad3a0980

  • SHA1

    75b4517cad56ce472ac09178eaf25d7ad0661482

  • SHA256

    50e06af7f8a6c59fb96a0ebdbb1256198c7bfae15ed450f6515e3ba3671655c2

  • SHA512

    279042841ca87bf5bcfc4940ab6d3033f3e8a53c86d1b5a6db387cbb6a230293e64376a3bf4c03d2387b177397bac457bcea8ffd2a10698ba03d8961a2c7256e

  • SSDEEP

    3072:2+LU2WP4yX5Pl80pq5j94Oe0dsUVwuTTJMlnrtnAENxiLW9MXY9hs:jDyQb94Oe0dsUVwufClnhAEp9Mz

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencespywarestealertrojanwormdefense_evasionexecution

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2