Extracted

• • Target
    file.exe
  • Size 11KB
  • SHA256 24c134595a2e38206674b3e4be0f57e00a29477c51103785dc18e937eebb6e57
  • MD5 4e8b770def5fa68ac9fdad816a5b50fc
  • SHA1 3a5e4683d6ba64238b0ea14d1062e3ab4e18cf07
  • SHA512 d5aae7a289d3b94201034e35189ee7e219b7224eb63fe5fac14a17170c5ce0757dfc68f1b09c4fbc0af96ea8c1eec5b2ec53254b01fca63fea9ca3162217cd5e
  • SSDEEP 192:yBdeU99M0CnUrfR6fBee2Hz3bJxTNerBthIjOu:UdT9MqR6fArzrBerBsO
  • TLSH
    T14B32190A684A5831F3E204B2277F829786BD1AA337D5B9DBF380764D0E753D1C17866E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryphorphiexloaderpersistencespywarestealertrojanwormxmrigminer

  • Phorphiex family

    phorphiex

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2