Extracted

• • Target
    2026-06-30_6f9463d0d62b4485daa68e1e64f2c5ff_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil_smoke-loader
  • Size 2.1MB
  • SHA256 ae72f68d62008bbf1cfad7d7141dfef4483d60fdb0cfe6213589c3104bd51dfc
  • MD5 6f9463d0d62b4485daa68e1e64f2c5ff
  • SHA1 5bbfe8b5f63ed2eaad92fd57db0e27c785a8442f
  • SHA512 2a73f446a3dd3a6efa151d30b15b82c57b3c860a3638b77affd7fe054d44505eee8566dbe86c44f9372f382ff1973e75d984045198caeb15b0c72dadc26a4b00
  • SSDEEP 49152:eaXFYqBuKbHVXhvDRZO0JftwdhWPKoGUcedp:ekFYqhzhhVZO0Vuh1oh
  • TLSH
    T17AA5AE02FBC295B2E587057A226B573F4D3AAE205324C9D3D7D129758D302D1AA3F3E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryphorphiexloadertrojanwormadwarepersistenceransomwarespyware

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2