Extracted

• • Target

    2025-03-10_c23f949038796e95200ced0c87dfe9d3_cobalt-strike_ryuk

  • Size

    1.3MB

  • MD5

    c23f949038796e95200ced0c87dfe9d3

  • SHA1

    0f08dc354f1442012c17bb0a362d079c1c1c5799

  • SHA256

    e5a1c9e2f955a638295362b0009dd956d57560f615f6e6198fb1bc8b43a5602d

  • SHA512

    192b1fe6103207164dc4304dbde4e03212645a26db930d99d3d672cb487be42733a341b39ddd45ac5fd5bfe972541b8f91dbd4e688ae904a969f2b19a847b11b

  • SSDEEP

    24576:2vEIcRBt7lTyWijhzrh1nYVnHSGwfmslQMcs:2cIaBRtGhHhyVn7UJZ

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2