Extracted

Extracted

Extracted

• • Target

    2025-05-20_f3e38385f4078c9a161f175a965e5735_amadey_coinminer_elex_gcleaner_rhadamanthys_smoke-loader

  • Size

    209KB

  • MD5

    f3e38385f4078c9a161f175a965e5735

  • SHA1

    9d736255b7bd06cd1f0a6a0496532809cf94af30

  • SHA256

    5f90433d277b0d292ffc7ce4f97883ad1f4e5d8847e350e733f09d5cb19c0b72

  • SHA512

    7dadddb22aa9bbd4b45bf73f8ad5af423ecc3aaf54b629ff0474b7d488b88c21bbb15f8ff4d4a0ef6b2e0a7a2b31525af06e4f9e8eb24897ef92045fea349d0c

  • SSDEEP

    3072:Q8s0PMq1GlEbrSVj5+w/I7aFJl1a5B0neIWG0hAPZ859+DmCOsq77IM:Q8PVGSbMv/2azbbnl0hAPZSKmCzeD

  Score

  10^/10

  phorphiexsalitybackdoordefense_evasiondiscoveryexecutionloaderpersistencetrojanupxworm

  • Modifies firewall policy service

    defense_evasion

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1