Extracted

• • Target
    2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat
  • Size 6.9MB
  • SHA256 56e46fc1b72123e8db23722e7cb5cffef5e507909cd89d12f4f778e8cb860e2a
  • MD5 770351c65bd8bae2c3e4679f31a27e9c
  • SHA1 faa246515a3e6b9401f886796464a197a68dd906
  • SHA512 48ca7afa0577650974b6766ca8895fed54450f96066c5ef1198242fe615e722430c6bd9443d527926caf490013e184552f51a6b618941a9758ae11252286b3c9
  • SSDEEP 196608:ursVYxyoZA6EWQ+QmWy2IjCZxPFHZX4GMrikaIwpxbL0s:ursyy76NQmWy7CZHHZaikaxxb
  • TLSH
    T1D976AE63B6408032C55203B06939BBB99EFDFDB00B76D197AF88215CAA725D1D73A353
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryphorphiexloaderspywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Downloads MZ/PE file

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2