General
-
Target
3bd5d7b72ff14e9979654f3079edaa96a885d1c80e579b46049ad06f79532131
-
Size
950KB
-
Sample
230423-3yxdyaab91
-
MD5
7ca685e8611d7bd7ef52bf3289e06681
-
SHA1
3bbc1c8e12ce1f8b576edf97feef855fdf4acac8
-
SHA256
3bd5d7b72ff14e9979654f3079edaa96a885d1c80e579b46049ad06f79532131
-
SHA512
5500b5bef1487c0af8c29ffb05210d3dba4c68ad40e24b0e1c1ed13301012bc1ec642446c1d46c57c13778c937c9d112a568f1a74651cffffbd6095fc2c7a998
-
SSDEEP
24576:9yIUoKIqvtu9ZCB3jDegJkwzI5fSZbUJgdP:YF2qFz3HeizI56dUJ
Static task
static1
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Extracted
aurora
85.192.40.255:8081
Targets
-
-
Target
3bd5d7b72ff14e9979654f3079edaa96a885d1c80e579b46049ad06f79532131
-
Size
950KB
-
MD5
7ca685e8611d7bd7ef52bf3289e06681
-
SHA1
3bbc1c8e12ce1f8b576edf97feef855fdf4acac8
-
SHA256
3bd5d7b72ff14e9979654f3079edaa96a885d1c80e579b46049ad06f79532131
-
SHA512
5500b5bef1487c0af8c29ffb05210d3dba4c68ad40e24b0e1c1ed13301012bc1ec642446c1d46c57c13778c937c9d112a568f1a74651cffffbd6095fc2c7a998
-
SSDEEP
24576:9yIUoKIqvtu9ZCB3jDegJkwzI5fSZbUJgdP:YF2qFz3HeizI56dUJ
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-