Extracted

• • Target

    2025-04-13_138805dcde04f82f4298d1a3ec248328_black-basta_elex_luca-stealer

  • Size

    2.4MB

  • MD5

    138805dcde04f82f4298d1a3ec248328

  • SHA1

    12a1c6024852fca44f5bb8164d569b5440709e90

  • SHA256

    01d3b793a25669ece3a6e4fa84ead0b4562f332102718edcc6fc211a25d19521

  • SHA512

    1cbbffb89a98190fe74720648e05de4a7c8605d5ef668b0efa8b76afc1caa27cb9dfbea46ce3faf1e345014b6453835824dc45c76179984ebb7504a3638c3701

  • SSDEEP

    49152:Kbv8a9HnIk8MC9Ohy0OiiRFp/PpScjZ3x/uO5Ktd:wvtHnIs7qPp3IcjP/uH

  Score

  10^/10

  phorphiexbootkitdefense_evasiondiscoveryloaderpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1