Extracted

• • Target
    2026-07-22_021b5389212b2a4d14ccf9367c2282b1_elex_phorpiex_wannacry
  • Size 46KB
  • SHA256 232565747f658956b6944d59aa5000dd52e0ae363cd38d1298733b0235c4edd4
  • MD5 021b5389212b2a4d14ccf9367c2282b1
  • SHA1 8a28d1d8e813bc91771fc61accc309f081534dfb
  • SHA512 698c7968a0dcc6ad84b28c5d31c9da14ec32cc1b2f804e1eb2f1898b6e5655f363c7d5197f91c6a11b3d6704e1362b62c2acee5d2a9f789daf38731b53e9ebe0
  • SSDEEP 768:NmDLbLS81Psb3TVCYumzFwAYJ2z6/3YwW2JcGU7Uz3Ng:AD3281s3hCzmzFtG3/3yAT3N
  • TLSH
    T1B523090AA2C14252F1F104707BB75F6ED43ABEB1170655CFDBE48DA52131BD1BA32B1A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionphorphiexloaderpersistencetrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Phorphiex payload

  • Windows security bypass

    defense_evasiontrojan

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2