Extracted

• • Target
    2026-07-12_44e82b7397c1b16f7768a58c6967dd74_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil
  • Size 3.0MB
  • SHA256 064b6ce39b592bbc03c626dcd4ce2b020ef9af2b23922d0a68e8aedb43a0f9f7
  • MD5 44e82b7397c1b16f7768a58c6967dd74
  • SHA1 22406cfb5ec5061425f48a38b715f42c53ddb448
  • SHA512 9725f3a5d035e49df50b0f0f9252c8cd4a66bc2f00034653448bde457df88500cda922c66b4a03f2222434203009e334ef61acbb6011e137d8177322d3fbfc6f
  • SSDEEP 98304:oYEFJhW6cXlQTaL6PL7j4pIERxazo2e+ywn:ojM6cXlQTaSL/4aERomwn
  • TLSH
    T1EEE5AE22FF019423F9D34172A2BF5BB28C3D9624136A94DBA6D11C789D302E2773D75A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryphorphiexloadertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Detects Windows executables referencing non-Windows User-Agents

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2