Extracted

• • Target
    2026-11-13_0800ff37ae5b8014d64f28c7effaa74c_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 187KB
  • SHA256 731a1552351618e0928dc53c7fcd56dcc9ee5b8a2c62344c20c4ab3e008e5631
  • MD5 0800ff37ae5b8014d64f28c7effaa74c
  • SHA1 87f6d6bfdcb8bb645aca0a0de9136b52ffb8ee46
  • SHA512 4064379607169a6e47a0210fd90adf11f2d7d0be76cd2dd1b473d7d93214c38c6500c8260857afbf9fab660ccbd1d431347c4828413ca83bbee031e94ea96447
  • SSDEEP 3072:J0oaFbW0U6QDYsYd1KWVwY3U/PdX0qTLX4TBfHyR7k/I9QLF2:J0t665sYdJwYE/PdX0qXX4TBC7k/JL
  • TLSH
    T1E8149D1672C0D072E177007446F5FBB10A79BC331A60A49B7FD86A7A1F316E1962A39F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionphorphiexxmrigloaderminerpersistencespywarestealertrojanworm

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2