General
-
Target
3d42c65185ffb3aa118b76d917f6fa16bb5ff09ffeb74e55ad8b1dcd6f59b602
-
Size
1.8MB
-
Sample
240327-jprbsafg79
-
MD5
045a6f2a649f8f819882e0c89cc33d93
-
SHA1
9a4408039998b9238cdd90e349c1b6fa7db8e5b7
-
SHA256
3d42c65185ffb3aa118b76d917f6fa16bb5ff09ffeb74e55ad8b1dcd6f59b602
-
SHA512
c4af91e15f79e287d55b903e3075ea654375612526c0fce4724f0fb9f25aec0c77f2d374918c782ace1cfadd287771513aa26f523435aabb7645d05f69367a9d
-
SSDEEP
24576:dd2YWCxfMBN7gvQ6JbkUDShnAaPLyi9NuV7gOmlqWMgsKTDEnyRBN5IHB9XL+rC1:dLyimRPL9Yc72yAHirz5CbFKnTu
Static task
static1
Behavioral task
behavioral1
Sample
3d42c65185ffb3aa118b76d917f6fa16bb5ff09ffeb74e55ad8b1dcd6f59b602.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Targets
-
-
Target
3d42c65185ffb3aa118b76d917f6fa16bb5ff09ffeb74e55ad8b1dcd6f59b602
-
Size
1.8MB
-
MD5
045a6f2a649f8f819882e0c89cc33d93
-
SHA1
9a4408039998b9238cdd90e349c1b6fa7db8e5b7
-
SHA256
3d42c65185ffb3aa118b76d917f6fa16bb5ff09ffeb74e55ad8b1dcd6f59b602
-
SHA512
c4af91e15f79e287d55b903e3075ea654375612526c0fce4724f0fb9f25aec0c77f2d374918c782ace1cfadd287771513aa26f523435aabb7645d05f69367a9d
-
SSDEEP
24576:dd2YWCxfMBN7gvQ6JbkUDShnAaPLyi9NuV7gOmlqWMgsKTDEnyRBN5IHB9XL+rC1:dLyimRPL9Yc72yAHirz5CbFKnTu
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-