General
-
Target
68BAF0A2165A4B775D6256443E6E9F25.exe
-
Size
30.8MB
-
Sample
210503-ctjyzj2xvs
-
MD5
68baf0a2165a4b775d6256443e6e9f25
-
SHA1
b09e52ac63736f8b85426e72dd8cb674d4d5263b
-
SHA256
e09cba714c003b6be9c6839fe167ef118107608c43f584368140c5e890b0a503
-
SHA512
fcf600c78472093dbb51deb8c45fb163f8a20c1d04465f273850f1928bd82b6296511ef15c5ffdc3bebd33512f3a018f20fa0f89c9e8ecf0794d9ffc4b9f9d5d
Static task
static1
Behavioral task
behavioral1
Sample
68BAF0A2165A4B775D6256443E6E9F25.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
68BAF0A2165A4B775D6256443E6E9F25.exe
Resource
win10v20210408
Malware Config
Extracted
amadey
2.16
185.215.113.74/4dcYcWsw3/index.php
Extracted
fickerstealer
51.195.94.249:80
Targets
-
-
Target
68BAF0A2165A4B775D6256443E6E9F25.exe
-
Size
30.8MB
-
MD5
68baf0a2165a4b775d6256443e6e9f25
-
SHA1
b09e52ac63736f8b85426e72dd8cb674d4d5263b
-
SHA256
e09cba714c003b6be9c6839fe167ef118107608c43f584368140c5e890b0a503
-
SHA512
fcf600c78472093dbb51deb8c45fb163f8a20c1d04465f273850f1928bd82b6296511ef15c5ffdc3bebd33512f3a018f20fa0f89c9e8ecf0794d9ffc4b9f9d5d
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-