Extracted

• • Target
    2026-11-09_7a97c67aa54961780d7d1372d87b79eb_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader
  • Size 1.4MB
  • SHA256 74a77ddecebb1738eda0418419ccda5caefe8b2d79cfa90d74ccdc8e526859d6
  • MD5 7a97c67aa54961780d7d1372d87b79eb
  • SHA1 c1c298e8887289547483d637ce7e17c1c800d928
  • SHA512 eca6f2a7f55ec0717d8f2e41245161195a2817a17ae2c01a82289982c701c1e48e5ebeddfd69783cbab453585c2650ba5e46beaf2e19e3875ae46fb0cd87e57c
  • SSDEEP 24576:yw8KjKjGFygcc23L1/NVOmOSGb6E3ecS4fzrjxJh9UZXlpbPvC7xtYUrEmFlo+Lj:iKjKWQc2b1FVgbjrjxPe1pbPSQm1FloS
  • TLSH
    T15765220172E08074F4F21E3069B49AB55B7EFD7469309A4B23990E3D6F38A81EA35777
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2