Extracted

Extracted

• • Target

    2025-05-20_fa0fec4bc7c3c9dedace59b120870a7b_black-basta_darkgate_elex_luca-stealer_mespinoza

  • Size

    1.8MB

  • MD5

    fa0fec4bc7c3c9dedace59b120870a7b

  • SHA1

    e694fc5db98d85facc34773b8dd382a663c94ffd

  • SHA256

    7cccf0cde62dd93d2b04ff02f08c49d1e1f68266fd22b189eb9837cd8679ec5d

  • SHA512

    5089e3548f3143b08d57c94983715e742431db1716664f1670a43957ce29f4d36595117ee132b65da215726017d482a914cf42927fef5fd2159fe36afe23517c

  • SSDEEP

    49152:gxsAzRLViin9l9488xQBgi4IfhoQe87y2X3nZEjEJDJo:wsAzRLIi9l1sQBgi4IfiWy2X3nZEjE

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencetrojanwormxmrigdefense_evasionexecutionminerupx

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2