Extracted

• • Target

    2025-04-14_27db8d4890c6699842726f11858ae56e_black-basta_cobalt-strike_elex_luca-stealer

  • Size

    247KB

  • MD5

    27db8d4890c6699842726f11858ae56e

  • SHA1

    4e076534775aa428c3697e658ea6d42a656d34a6

  • SHA256

    cd13d7872186301845faf0a63a5e921f9d32faf5a3e51b5fb7a2936646b93792

  • SHA512

    cf5778a5902b27e6d2045d3e76de2c9ad4904763a1cdc55e0306196765896df9fe1aadc3693b9c1d1b71d19ec0e72cddb518089c870aaa091bd9d3ab438825d8

  • SSDEEP

    3072:GeJbDwLibLaZ/S91gxiJPU3qtmQv2cthYSdqMREwPLr6VsOWPGWyrVFsQMeJqeuQ:GkDOZargxSHmQv2+B9EwC/sQMeQLqv7

  Score

  10^/10

  phorphiexbootkitdiscoveryloaderpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1