Extracted

• • Target
    2026-11-09_ff3c2eaa7b0f292edca7d5ee8ac5638e_amadey_avoslocker_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_remcos_smoke-loader
  • Size 2.2MB
  • SHA256 f078d1514de50f13adbf6d25f43daeef7d8976f967ce262dd35a4b422c3a84d8
  • MD5 ff3c2eaa7b0f292edca7d5ee8ac5638e
  • SHA1 cfb539fece67d73da5cd5b41d93e0c4939623e3f
  • SHA512 5f2749be55dd35c152106020b29be79e7981849bdbbc2622e8e3f9e541533664a5f17c79d59e70f0ce8b4fc530c2202b421f14e19ac9c0b772d4a0524f0cdc45
  • SSDEEP 49152:dOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/:dOU/jIEeQfoR/IuOFVjUu5
  • TLSH
    T1C3B58D12BAD58432F1B312319DB8C2695674B9A6473689EFB3CC561E4F309C18E32F67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2