Extracted

• • Target

    2025-04-14_d253ec7aa6372a86839af0c6240ea009_amadey_black-basta_elex_luca-stealer

  • Size

    2.5MB

  • MD5

    d253ec7aa6372a86839af0c6240ea009

  • SHA1

    38928483d5a187256a9a35e76d568adb94205cba

  • SHA256

    3df6732e54e92bd18126f2d4e93180bcccd4b43aa001a468426c087305244aaa

  • SHA512

    c2e264e10932808b89ba98d210f95210863d6597829b211e657a17c3cd484db7c8fc7c71c1bbfa59ddfc7ac40aff169abb1d06c175b3b3f699bac686816c897f

  • SSDEEP

    49152:NE8I6oEK7uzgRTvnFjStQyfvE0Z3R0nxiIq2dseYGVX:NE8IjzuzgFt7KtQRq23X

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1