Extracted

• • Target
    2026-11-09_03731be80c89491e7ab64b29b0538619_bkransomware_elex_hawkeye_maze_remcos
  • Size 461KB
  • SHA256 f845c9a7da9997a54a34292c76c9db974b4717610680c0a8baca8064e2ff1c4a
  • MD5 03731be80c89491e7ab64b29b0538619
  • SHA1 3ad164c83ed3274863a9dcae01a990bdbf2c4160
  • SHA512 5a1c7cb2bd0f4d3d886d312ec68cda5efc924eb57e0c9f0f2e46d848130ba7b6093c11983657bb0d9a2d3cc901dd20a16df1cf1ce0a4e3495fc3bdd58efdeba8
  • SSDEEP 6144:1v9/qzrnuGXBCzraOjHElFnRdOsNtns8ciWPbDm6N9RF:1g49H61RgsNtbAd
  • TLSH
    T1A6A40902B7E99134F2F31B31AFB592655A7ABD629D35C60F23C41A0D0DB0980EA75B73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2