Extracted

• • Target
    file.exe
  • Size 10KB
  • SHA256 5074181ece52b0e35f86c2c1acd023c7205f861426f21d303cbbdc23e8b50a68
  • MD5 bdf2f9676976112b7d2ea2e37c6be373
  • SHA1 4aef7302f845089e4a16507123570edb4b12197e
  • SHA512 34da78668862a2ec14cede7d7d2968eaaf1fd3eb512666c93514d59d12d87d931c857b0777afe5d30d43618a28aeca26141c5a4e1c9c8550bbbe3dbef42be93d
  • SSDEEP 192:GolpS5BHVxSHO825fWsUPFJxTEZmFhqecR:GocVsubxFUPFwZV
  • TLSH
    T1DC22910E2D4B4321EE5108B0F675464A543D1EE37346FBDBE632D5CB0AD6E4884C1AAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencetrojanwormadwareransomwarespyware

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2