Extracted

Extracted

• • Target

    f822401c5799952f843f8516d49e390c9193030fc00b396d54a2800fbeedc4ae.exe

  • Size

    148KB

  • MD5

    7191865f28c73ab181e3cefa95b0f385

  • SHA1

    64617103389e42aef8e6d6742061b99b29ae45be

  • SHA256

    f822401c5799952f843f8516d49e390c9193030fc00b396d54a2800fbeedc4ae

  • SHA512

    d0020b9d7a831bbe9a7aa5789f35b1a31da5746dcdec16cd9ba08ef50ed40f35f2862e44f10c9024a2a681d6cc61ddfa375c86435c48c4805e09bd897b1c31b9

  • SSDEEP

    3072:2+LU2WP4yX5Pl80pq5j94Oe0dsUVwuTTJMlnrtnAENxiLW9MXY9hU:jDyQb94Oe0dsUVwufClnhAEp9MB

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencespywarestealertrojanwormdefense_evasionexecution

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2