Extracted

• • Target
    file.exe
  • Size 10KB
  • SHA256 2181e3938d19e6b620e9f95f0790504d64ba19d3f450c34f4ec4d1e87c39026d
  • MD5 80e7089cffdbeb0595e33227e9b4bbd6
  • SHA1 994f9d84007faab75d516b997331fd010c18956d
  • SHA512 1078a0ef5de9eb52e08049bff4a519d7334b11696ba9f21f67bb012eaf25ec9e251d4f45e612a01c46de2854b17c34c53aa51fb8e5dc47f1e5fbee6694fa22fe
  • SSDEEP 192:A6LoqaTBgx+ealq50350EPFJxTEZmFhSKOmV:A6LoxWwpBPFwZ4V
  • TLSH
    T11A22192A7E4A0331D3D488F45479838F653D5563A787E3EBF373A59A0BA63488440DAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencetrojanwormadwarespyware

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2