Extracted

• • Target
    2026-09-05_67a111cd5c442c630add9a48ecca73db_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc
  • Size 5.5MB
  • SHA256 202c6c4b0879b47f30bb89bd05261752ede43c9fa0b3df5c0b5cd37d712cf330
  • MD5 67a111cd5c442c630add9a48ecca73db
  • SHA1 777e16a1fd4ae31b76167fec8df03f5597ad7b00
  • SHA512 a6b29e3bf994fbbfa08b22e15d8bc00354d291adc4bac8e2fba4b2738d23bbe1b38766f9ca76b180141581dc9342e1077cbc8ce2e9f9d6ee2cf9b5f221ef0f3f
  • SSDEEP 49152:OGtlqBJkIU6iYVwASOnMs2IAlheHaEXMQVkWw95jpBcrhUpPWPKV1/fqNcx/O5kv:kl+0x9FjO509oZqNcxfH64NWgr28z4VE
  • TLSH
    T182469D56A6A450ECD5B7C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryspywaretrojanphorphiexloaderworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2