General
-
Target
5b6f99b90ce37d2587519c490562c7a44bf33a1df50994534fa5c49e203efda6
-
Size
574KB
-
Sample
230206-tmp12seg57
-
MD5
090c2b5d4b1b284331367088a2f896e4
-
SHA1
af0b0cd65c409fd28fbfde5027760b4ca79cb5d8
-
SHA256
5b6f99b90ce37d2587519c490562c7a44bf33a1df50994534fa5c49e203efda6
-
SHA512
64285a95c8671706acb1a6af29904acef2fa8a94799cc64f736492a94af9de1eb21a077cb9bf8726022f9946d5fd18a1db6ce14ab3cebe528b7b7ccd47a3f91a
-
SSDEEP
12288:aMrny900yVRPVgPQECSuXDdLFJUJWKEeAUOH7hDfcoc:ty+V9zdFXwA3H5fcj
Static task
static1
Behavioral task
behavioral1
Sample
5b6f99b90ce37d2587519c490562c7a44bf33a1df50994534fa5c49e203efda6.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Targets
-
-
Target
5b6f99b90ce37d2587519c490562c7a44bf33a1df50994534fa5c49e203efda6
-
Size
574KB
-
MD5
090c2b5d4b1b284331367088a2f896e4
-
SHA1
af0b0cd65c409fd28fbfde5027760b4ca79cb5d8
-
SHA256
5b6f99b90ce37d2587519c490562c7a44bf33a1df50994534fa5c49e203efda6
-
SHA512
64285a95c8671706acb1a6af29904acef2fa8a94799cc64f736492a94af9de1eb21a077cb9bf8726022f9946d5fd18a1db6ce14ab3cebe528b7b7ccd47a3f91a
-
SSDEEP
12288:aMrny900yVRPVgPQECSuXDdLFJUJWKEeAUOH7hDfcoc:ty+V9zdFXwA3H5fcj
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-