General
-
Target
b41556e99148464d98e7aaeb6dce4c0995dc5f549d436e09b0000c26273de141
-
Size
187KB
-
Sample
221124-zwp1ashh29
-
MD5
dd500be598d1db9eab28b3052a71039f
-
SHA1
e01aabb8620a7d2ccc648ef84cdd37a57cc4d919
-
SHA256
b41556e99148464d98e7aaeb6dce4c0995dc5f549d436e09b0000c26273de141
-
SHA512
01f6adfa566859dae85fcf2da1a3ee36289416384fe916d54328666f771ba1cd833fbdfa9dd4cc8abeba98962b898773e1a5c526cf9d0445f9df83cbfed615ae
-
SSDEEP
3072:x8sYrItgCeqGtktLaG3P+7QM5FUFC1T/xr7I2+ECxtMV8K:qrn4Law80yT/pEwCxtTK
Static task
static1
Behavioral task
behavioral1
Sample
b41556e99148464d98e7aaeb6dce4c0995dc5f549d436e09b0000c26273de141.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
amadey
3.50
77.73.134.65/o7VsjdSa2f/index.php
Targets
-
-
Target
b41556e99148464d98e7aaeb6dce4c0995dc5f549d436e09b0000c26273de141
-
Size
187KB
-
MD5
dd500be598d1db9eab28b3052a71039f
-
SHA1
e01aabb8620a7d2ccc648ef84cdd37a57cc4d919
-
SHA256
b41556e99148464d98e7aaeb6dce4c0995dc5f549d436e09b0000c26273de141
-
SHA512
01f6adfa566859dae85fcf2da1a3ee36289416384fe916d54328666f771ba1cd833fbdfa9dd4cc8abeba98962b898773e1a5c526cf9d0445f9df83cbfed615ae
-
SSDEEP
3072:x8sYrItgCeqGtktLaG3P+7QM5FUFC1T/xr7I2+ECxtMV8K:qrn4Law80yT/pEwCxtTK
-
Detect Amadey credential stealer module
-
Detects Smokeloader packer
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-