Extracted

Extracted

• • Target

    4c52cf849be8954638925c242e0cc976.exe

  • Size

    10KB

  • MD5

    4c52cf849be8954638925c242e0cc976

  • SHA1

    949ba0061ea9dbe3b9059bb2a7b20caa74861280

  • SHA256

    fa6fcf2e154c0b18b12ab86267ccd38d79cc9c27e7e261a7e9201a0a9dd9d0bb

  • SHA512

    c11572dcd274bdcb5e94cf38ec36aa65e4d5605df250ee8887cd5098b044e3e2e71be3b3292118b967e27bc752b5cf5d9c8da5ac2834b7c156302c307abe123b

  • SSDEEP

    96:/L0paShFKPqYTdGLDad04DCcR+58DsrVJQsfuJxGEOaRh2qhRC7tCEMSI:/2hBMGtkR+iDswsWJxTOchthyMB

  Score

  10^/10

  phorphiexdefense_evasiondiscoveryexecutionloaderpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  behavioral1behavioral2