General
-
Target
file.exe
-
Size
6.4MB
-
Sample
231221-ygys8aebe3
-
MD5
0607a527a8ef15720f3bee3a134d3e76
-
SHA1
9777a7ffac5e18b9b8b9a566a1be17f0ab1ab402
-
SHA256
236b141121d5f8772f85bf485a6675102c871e22734bcb8f2e11478c2d8d3365
-
SHA512
e23c17e0cee9aeff608712f5b919f7862bec9c4391de4dd7efc84e16f58497728a564bec9444be7f68d60d58b19ca0b40983485bdc15a57d273fc043729a5813
-
SSDEEP
196608:l1cMrm+eLFVlfqATlzu6TJDFqODrncCIexHIKfU:lzsLFVlxi6TZcOVIcZ
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231129-en
Malware Config
Extracted
amadey
4.13
http://185.172.128.5
-
install_dir
4fdb51ccdc
-
install_file
Utsysc.exe
-
strings_key
11bb398ff31ee80d2c37571aecd1d36d
-
url_paths
/v8sjh3hs8/index.php
Extracted
amadey
http://185.172.128.5
-
strings_key
11bb398ff31ee80d2c37571aecd1d36d
-
url_paths
/v8sjh3hs8/index.php
Targets
-
-
Target
file.exe
-
Size
6.4MB
-
MD5
0607a527a8ef15720f3bee3a134d3e76
-
SHA1
9777a7ffac5e18b9b8b9a566a1be17f0ab1ab402
-
SHA256
236b141121d5f8772f85bf485a6675102c871e22734bcb8f2e11478c2d8d3365
-
SHA512
e23c17e0cee9aeff608712f5b919f7862bec9c4391de4dd7efc84e16f58497728a564bec9444be7f68d60d58b19ca0b40983485bdc15a57d273fc043729a5813
-
SSDEEP
196608:l1cMrm+eLFVlfqATlzu6TJDFqODrncCIexHIKfU:lzsLFVlxi6TZcOVIcZ
-
XMRig Miner payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-