Extracted

• • Target

    2025-03-10_d918980d1484deffcfa471b890ea91b5_hijackloader_ryuk

  • Size

    1.1MB

  • MD5

    d918980d1484deffcfa471b890ea91b5

  • SHA1

    6c47d08adb28df9d1a1c91f577779d58396b2121

  • SHA256

    c004247f123066bcfb70264dc60756756c21f75d5cb5c6dd7d440498335681ba

  • SHA512

    6c8b6e93233bb566174313942f23b0db1c2ce06ceda4b47c2b9e6d7bc8f8af31a2fda12ec2ec2c5d955df05a432a18cdb9c55187b9567851a8cff359a5763f3b

  • SSDEEP

    24576:NzsgAzDeeBtuzLDdk4kHw49x9XTxpPdIo4Me88Zbc2N6:NiPjunDeJXxUoi8Cca6

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2