General
-
Target
samples.zip
-
Size
110KB
-
Sample
231130-vg1e9sed72
-
MD5
a51d1208e587250b79b46e0af954ca65
-
SHA1
3f693e7050f823fe9e42d5297a3805f4d07fa7bd
-
SHA256
c3f8fa15de7270ae9998b33c1ef0c89c41a9a827cddee9270d4c43a216032206
-
SHA512
52c17e3c98efa2ecccfec74e334a839b9ab02742c4a7670bc986e0def849594fac9d4791a4eed9c550ef4616da9eb3a657eac599cb913cb016038df5db9de240
-
SSDEEP
3072:Yt4asn+dt19gAIcHWy7hR//6BbdisKGj92w8Z:Ytxsn+dt1ndHTVUp13j925
Behavioral task
behavioral1
Sample
b00302c7a37d30e1d649945bce637c2be5ef5a1055e572df9866ef8281964b65.exe
Resource
win7-20231023-en
Malware Config
Extracted
amadey
3.66
http://62.204.41.242
-
install_dir
4b9a106e76
-
install_file
nbveek.exe
-
strings_key
363c314b34b4864ac6a85f962c5ac734
-
url_paths
/9vZbns/index.php
Targets
-
-
Target
b00302c7a37d30e1d649945bce637c2be5ef5a1055e572df9866ef8281964b65
-
Size
235KB
-
MD5
6779cd6f17fa7536c4490cc6d72a00a0
-
SHA1
2976ecc0ecc2800be22fa92868c2173a44e04ee0
-
SHA256
b00302c7a37d30e1d649945bce637c2be5ef5a1055e572df9866ef8281964b65
-
SHA512
88e8e38e1c664ebe1aa3c9f7601496b83f3c7ca9916a49573d169a33ae697602737505aaa2af755b6bea19dc38064742876b585a41c6ffaac172a44fb8bdc482
-
SSDEEP
6144:eLUoeyDABOdDubDXqgraG0JzSRuVyL+VYjQqgE:elu0LgwJ4uVyaV+J
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-