Extracted

• • Target
    2026-07-09_058f59b82061111c842a0594ae9c120e_akira_cobalt-strike_icedid_njrat_satacom_vidar
  • Size 3.7MB
  • SHA256 0a5607c8298448f1781a20ef5d7416c0d8aaa27030fa383b8ae55f68925e5095
  • MD5 058f59b82061111c842a0594ae9c120e
  • SHA1 20a880bbc292b669212850d6d15a83bbaa114448
  • SHA512 ed046d1275781bfb16cbae9688e8eefdb67e60a079ab59c05557924ad8c2f2bf08590344e3c55ec7c38e8bdfdee241adec0d4eb96c3e595ede0020b833c2bd6f
  • SSDEEP 49152:GmVGUnKURKczI44OCmRUIuRxB/cBywTKKxGR42:/zK7JTKxsb
  • TLSH
    T17206FA12E7650DE2D99380B0CD766B22CBA6BC7C0BF107777B3246DEA86B2D03526745
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryphorphiexloadertrojanwormadwarepersistenceransomwarespyware

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2