Extracted

Extracted

• • Target

    2025-05-20_e9e24a48f89e89d5ffd9720411a9b0a9_amadey_darkgate_elex_rhadamanthys_smoke-loader

  • Size

    4.5MB

  • MD5

    e9e24a48f89e89d5ffd9720411a9b0a9

  • SHA1

    24e044f9dc1779f2b6fd40c3e00555dbb82e3d5f

  • SHA256

    0673c9a8847ecc2b306a3402abc711fb95ecdd490bdc5564eb811d7e664dfa68

  • SHA512

    29361165db238c6d5fb691ac129e0586ff68a4afe0c67b16b6e445f48c811652bbd7bdf4f1422533dd950a4e5d82f0cb1251459f94449410ed0c255b4056fa8d

  • SSDEEP

    98304:6fzOGN00T4mrSQbU+u458MOqt8poMTdb+XxWNaCUHVQg2hW:O4xQeBqCpoNCUuZ

  Score

  10^/10

  phorphiexbootkitdiscoveryloaderpersistencetrojanwormxmrigdefense_evasionexecutionminerupx

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2