Extracted

• • Target

    2025-04-14_bce4c9fffc43e2281706631744d6cced_black-basta_elex_hijackloader_luca-stealer

  • Size

    10.2MB

  • MD5

    bce4c9fffc43e2281706631744d6cced

  • SHA1

    c877c71a499e9e7521b28d54561ca61664e761da

  • SHA256

    7b156470879a855d50e141919c3e03b107ff64dbda7709b2dbeeefea8c09762c

  • SHA512

    469d31956e2cdcd69a6aa63dbed5c9e5a9914c55299913eac92960c9faacef339e2d7bb729ce70d1e9d797e77fa893aae376314e31ffd478c685cce7aed8aa7f

  • SSDEEP

    196608:/3FY0NuFehMgTctuuYPHOs79Jbp0xtJ62LtAAnAcErVs5uopx+mOb:/3FBNUycM7REJ62JnarV0lx+b

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencetrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1