Extracted

• • Target
    2026-11-10_ed7219860d8d8778245bacebd83dcdc3_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 244KB
  • SHA256 18fa528f6d15b111b194ba722cb3d2accccc3d41d0a6b64e72f558ad04923d05
  • MD5 ed7219860d8d8778245bacebd83dcdc3
  • SHA1 1454e35bf21725d11e9a813b2795c8960af6e955
  • SHA512 453589346be3a490373644fc63c473265019243a6df07cc60ca71998dd2efaa2e26528f01f847f90e88fbc34b3280044ce80d8d0a7d27e46d514bd52d615358a
  • SSDEEP 3072:08ZKFWhufKVeJVtTavlWa8NYf6/oIMNh5BIIuyF7ZHWAAf:jZKAjVeJVtTa0FGycnHuf
  • TLSH
    T1AA349E217292C8B1D41A41318829CA700666FD73A9B045EF2BD97E3F9EB12C2567737F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionphorphiexloaderpersistencetrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Phorphiex payload

  • Custom signature

    Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Custom signature

    Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Executes dropped EXE

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2