Extracted

• • Target
    2026-11-09_ceee8a17c5fb51d11cbf566d090663e9_elex_wannacry
  • Size 24KB
  • SHA256 1e1b9a53ca3f33fe450a78e35748cd0bc6e53b4acb22d5981a1402d949ff82c2
  • MD5 ceee8a17c5fb51d11cbf566d090663e9
  • SHA1 c103f582edfa827b8ee23bed3728befbc9e0bddb
  • SHA512 ac73ed4a5af61a6fc88545c9582b6bd9f7319454ab814b702d6ae3f2ad884045e67cb406afa3510e1026632e92523fee813c0d0c6f5cbabce41a6d86a904cd63
  • SSDEEP 192:oxpice4WZVuCBeQax+hyGhPP1oynAeS6iCUo4Yg3ZZHEBCvu1LNFaGSmOaKu:ox1vkaG16eSlBY2ZZfu1W8P
  • TLSH
    T1CBB2E602E6A586A6E210CDB207BB5E3A0935B4731B4556CFA791DF5DB830FC09C22B4F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexloaderpersistencespywarestealertrojanwormxmrigminer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence
  behavioral1behavioral2