General
-
Target
setup.exe
-
Size
898KB
-
Sample
230424-ak2saaac9x
-
MD5
5aadc98d71baa32b9a42daeb1570e48f
-
SHA1
fcdbc81e8e7206fb98da9fa7339e7281e14849ba
-
SHA256
690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8
-
SHA512
b03fe90250d857042a50dd659773a87196485e99eec0c83f1719d5fbeb4abeb97cef85ca28e5ab9f9046dc45c8f1aa43b1dabeb81845469dbfb70e466bdfc309
-
SSDEEP
24576:tyRAeKyKs/lvfX1LI27pzP41JOZI3awOD4z+yjdF:ISeNtVLxPDZI3JnP
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
setup.exe
-
Size
898KB
-
MD5
5aadc98d71baa32b9a42daeb1570e48f
-
SHA1
fcdbc81e8e7206fb98da9fa7339e7281e14849ba
-
SHA256
690a0c8356c18e5c281e9403a7a63de8448e1a1cba798e7ea6be3d1c72d50cc8
-
SHA512
b03fe90250d857042a50dd659773a87196485e99eec0c83f1719d5fbeb4abeb97cef85ca28e5ab9f9046dc45c8f1aa43b1dabeb81845469dbfb70e466bdfc309
-
SSDEEP
24576:tyRAeKyKs/lvfX1LI27pzP41JOZI3awOD4z+yjdF:ISeNtVLxPDZI3JnP
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-