Extracted

• • Target

    2025-03-10_57ac41e88ea899c168f4dd4565967cc9_cobalt-strike_ryuk

  • Size

    241KB

  • MD5

    57ac41e88ea899c168f4dd4565967cc9

  • SHA1

    799bd94b12b04ef4cfe81b0a89003eb59e68051e

  • SHA256

    12f03c7de3829dae0dbd3b9bc5222cd564cd516e703b13e808444780a3400027

  • SHA512

    4ddc221168518e9f37dafc9b69ff6c2fa31f01f34edebdad6898dfc4208d88c2d0a8273a7ea85ea58f77895ca9ab23666d8619d8af4aa986587d651e772593b6

  • SSDEEP

    6144:Lsw4Nsz1LC/QrE26VY/p15UJAQl7jgJSqV:LT9C/2me7u7kSqV

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1