General
- Target AMED.exe
- Size 551KB
- Sample230413-k16fhsad92
- SHA256 f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad
- MD5 a507ce96d65b8ded1a32998e65c65cc5
- SHA1 db43868ad7aa5517998c7c486d4b564d3a683621
- SHA512 15baaef10520d9898aed0e5ceed4bb98f4122c07da69585d4843105f0d79e77aa75c098fcc29db52a14cb80b5a17a5a927288676ab3fe9d1ffec815f36803976
- SSDEEP 12288:tX0+hk6HUIzCjgY9xaYZRykP8/fK+F7U+yMC3anu:90WKGC/9xZkkxEmM5u
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
AMED.exe
Resource
win7-20230220-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target AMED.exe
- Size 551KB
- SHA256 f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad
- MD5 a507ce96d65b8ded1a32998e65c65cc5
- SHA1 db43868ad7aa5517998c7c486d4b564d3a683621
- SHA512 15baaef10520d9898aed0e5ceed4bb98f4122c07da69585d4843105f0d79e77aa75c098fcc29db52a14cb80b5a17a5a927288676ab3fe9d1ffec815f36803976
- SSDEEP 12288:tX0+hk6HUIzCjgY9xaYZRykP8/fK+F7U+yMC3anu:90WKGC/9xZkkxEmM5u
- MD5 SHA1 SHA512 SSDEEP
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext