Extracted

Extracted

• • Target

    2025-05-20_abde568d25e51c4a93fef771ce567616_amadey_elex_smoke-loader

  • Size

    413KB

  • MD5

    abde568d25e51c4a93fef771ce567616

  • SHA1

    68acb52092b009a8fa36fd8ff0b9971efc45ad9d

  • SHA256

    b25b78f44ed81297144b88364d8547d8bba3a6b809e5e817afe00e45facd6024

  • SHA512

    2687911e996daec770de4d3c643e77b311c9785c8f67f77935b4797cee40db09321c09851c866712c24e42aaa041b58178faa68bafcecba51ba8158bb05993d9

  • SSDEEP

    12288:RS8pyu8vquNsWvC3bTm7npfqqRIrr/d8c:5pHruNsW7npfq4k1

  Score

  10^/10

  phorphiexxmrigdefense_evasiondiscoveryexecutionloaderminerpersistencetrojanupxworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Stops running service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1