Extracted

• • Target
    2026-11-04_9f7fc1cccb21bea3b427fe6c6ee23005_elex_wannacry
  • Size 24KB
  • SHA256 4d7386e316f70511df5728e0d5c2ec42d05b35c3c51c6d58f93d6555ed302937
  • MD5 9f7fc1cccb21bea3b427fe6c6ee23005
  • SHA1 72ae1849d5d8bd20d9eb850457eaf92067d180b5
  • SHA512 5b975cfd2766e55012c71fe99a5fed9486eb1ab6fedd06588e6c69f7959cb7cdb7cbcc5ec01218899cec7af7557e3cc966f3b552590710f0cb9504ebf6d642ba
  • SSDEEP 192:oxpice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEBCvu1LNFaGSmtaKu:ox1vkaG16eSlBY2ZZfu1WFP
  • TLSH
    T10AB2E602E6A586A6E210CDB207BB5E3A0935B4731B4556CFA791DF5DB830EC09C22B4F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2