Extracted

• • Target
    2026-11-09_086e1b7e98eaa61fd61ea6d64e788f6c_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat
  • Size 3.9MB
  • SHA256 6bcac592857f80e89dd0ed9a8c8d03375dc3a23f03c6100736989e9b4a910d15
  • MD5 086e1b7e98eaa61fd61ea6d64e788f6c
  • SHA1 09b16171c6caac3cc5c653eadc0bef165e6f5e5d
  • SHA512 96b9f2ecdb0bbbd2be9634a86a94c57aa01084dd707a93112b0e222c751d75817d0cb3f2ca4442bfa3755a90d89226c4b65605df1cb2c2fa3031f41c1945c0bb
  • SSDEEP 49152:0KKfHPZ6IVMv76K8ocsCGzzJ7UDv7zuBcLAqw1Gjg+A2deCMmwV/vJu2mWG2mrk:0/fh6ImzzJoDfuBcMv+A73XA
  • TLSH
    T17C166B50FEDB95F5EA035A3045A7A37F6330A6098335CBC3CA405FA6F957AD21A33216
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencetrojanwormspywarestealer

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2