General
-
Target
f936ae13100b11f0a4729741f5c0d622f1fd898e24bb8c8a4667c500ae9cf8c3
-
Size
642KB
-
Sample
230206-nv1vmaha4z
-
MD5
40bcf69174c43b6d72ba9308a5d369c1
-
SHA1
078051b7a8ea51eb4e1396525fea60d937fe02b8
-
SHA256
f936ae13100b11f0a4729741f5c0d622f1fd898e24bb8c8a4667c500ae9cf8c3
-
SHA512
bb266d404d17ff91ad6069fda7ee8dd0e0ef1eed7b1f14b51a08e1d48c3712c6cd46545626867731a3e7857ed5af2b8e33988d6b44d7f858b0f37c16833b3f46
-
SSDEEP
12288:KMrCy909CNiVyuH5s7p11EbSauq8W4o3XqcGMYmAdsOXs:cy8CIVtsV11EuaIW5qk5os
Static task
static1
Malware Config
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Targets
-
-
Target
f936ae13100b11f0a4729741f5c0d622f1fd898e24bb8c8a4667c500ae9cf8c3
-
Size
642KB
-
MD5
40bcf69174c43b6d72ba9308a5d369c1
-
SHA1
078051b7a8ea51eb4e1396525fea60d937fe02b8
-
SHA256
f936ae13100b11f0a4729741f5c0d622f1fd898e24bb8c8a4667c500ae9cf8c3
-
SHA512
bb266d404d17ff91ad6069fda7ee8dd0e0ef1eed7b1f14b51a08e1d48c3712c6cd46545626867731a3e7857ed5af2b8e33988d6b44d7f858b0f37c16833b3f46
-
SSDEEP
12288:KMrCy909CNiVyuH5s7p11EbSauq8W4o3XqcGMYmAdsOXs:cy8CIVtsV11EuaIW5qk5os
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-