Extracted

Extracted

• • Target

    2025-05-20_8ac4032ea31e0644a91319355491c8ad_amadey_black-basta_cobalt-strike_elex_hijackloader_luca-stealer_smoke-loader

  • Size

    539KB

  • MD5

    8ac4032ea31e0644a91319355491c8ad

  • SHA1

    42c35158b6927624b4f28d2325d3b66ee87236e9

  • SHA256

    3d5e25912b7d536eaa4c7fd85772c53a86b69286b6fff301173f02a3bb92f0ab

  • SHA512

    b19ee30e9a51e1b9ee78e1a47680f13fa544cf41910481b961115866dda7c627c621a84f47374d4c15524ddaa97dde6a87c42284de13b36614bb3f2fb87cd160

  • SSDEEP

    12288:YzJYCujT8OtizWvJ0ySv1//kwgQJsE+EOWIrLnoW:AZu38ei71Hkf+YElEb

  Score

  10^/10

  phorphiexdefense_evasiondiscoveryexecutionloaderpersistencetrojanupxworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1