Extracted

• • Target
    2026-11-10_a4becd99ef822e4039eec1d09a77ea36_elex_rhadamanthys_stop
  • Size 419KB
  • SHA256 960f64871786a9dd172be53e964dc7d198e20da8002d2b28a5d9b89c4d1b894a
  • MD5 a4becd99ef822e4039eec1d09a77ea36
  • SHA1 85b0639fc9e2cee82fb32c4af9cd6c609e8e0534
  • SHA512 1924a522a175b1a9a58620550950fc31b09bc7df85cce50703f68cf03c5491963d6bd27b69ecd84d07ab98382e02b031870954ad577bdf7d50471a3f4c3b20d9
  • SSDEEP 6144:A890CA0QawtUrqNUk0BX3h3KuemLqd7C1io0edeuVkHbHnHPAqYvr6yRI:5a0wIk0BX3RKuemGd70ioGuVWW6oI
  • TLSH
    T103947C1037D08136F1B329368BBFD724542DB8715F6986CFA388166E5E70AE1EA3171B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2