Extracted

• • Target

    2025-03-10_22876a5c21c852ae5481a34daa9f700f_cobalt-strike_ryuk

  • Size

    434KB

  • MD5

    22876a5c21c852ae5481a34daa9f700f

  • SHA1

    952fa56ebac67a76a5e783e2d30a39db4eb28625

  • SHA256

    c45c9f642d59535a4e75a0ddba3e8cc5b05307d533cbbd4a3bd4d664ca563624

  • SHA512

    0868353ab768f1a6b925e3926532e91028423e01d4bdce63b2f41a2a6cd7dcb581c322896f0e68aca76ce976cfcf91c88b7709cb1d6a3436e6ad3368719ffd90

  • SSDEEP

    12288:dQSynczytI/cAPzOgccRye/RKvj6+OTsEP05RPJAdGy:aNcW2KvjiP0LJ+R

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2