Extracted

• • Target
    2026-11-06_f5a80aa56107d535770d36b1c5b43fab_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader
  • Size 1.4MB
  • SHA256 58d1fb6b63d8a0ed760363092a576d5bb07c2065e984e6a0f0fc7a8298f1da89
  • MD5 f5a80aa56107d535770d36b1c5b43fab
  • SHA1 f8ec364890f6ea7f58acc19e712b4987ea20c961
  • SHA512 3b6a919100f36d7396c7deda2a3286c7706631127f521c88feddaf0c34482e44005152e42e33d33b6e9ab8bb237e898d8cf983cc72533c1af019e2a4e2c568be
  • SSDEEP 24576:yw8KjKjGFygcc23L1/NVOmOSGb6E3ecS4fzrjxJh9UZXlpbPvC7xtYUrEmFlo+Lj:iKjKWQc2b1FVgbjrjxPe1pbPSQm1FloS
  • TLSH
    T17B65220172E08074F4F21E3069B49AB55B7EFD7469309A4B23990E3D6F38A81EA35777
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2