General
-
Target
ad4e448d25169180137140041da70ba41fcdffe8acad53c668b4d8e0bb2fb905
-
Size
1.9MB
-
Sample
240331-szs3sseb6x
-
MD5
a9fb0860e04f67fc219bc746f7c2beaa
-
SHA1
8699d87a34838bf36fa93cd6e9f2ecb82213ff10
-
SHA256
ad4e448d25169180137140041da70ba41fcdffe8acad53c668b4d8e0bb2fb905
-
SHA512
e76d4aedfe756024e74d440bcd8102a2ff99227d06f810ff6a99368d0f412b0e95de3baf10cdad81ea7948915f68705b2b724085dc2bb927a5cbe88d08732749
-
SSDEEP
49152:9X5C5WFHzkvvlJ4FDaMDxna3nt9R++3HO:9J+iHzkv9Gz+B+Ou
Static task
static1
Behavioral task
behavioral1
Sample
ad4e448d25169180137140041da70ba41fcdffe8acad53c668b4d8e0bb2fb905.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Targets
-
-
Target
ad4e448d25169180137140041da70ba41fcdffe8acad53c668b4d8e0bb2fb905
-
Size
1.9MB
-
MD5
a9fb0860e04f67fc219bc746f7c2beaa
-
SHA1
8699d87a34838bf36fa93cd6e9f2ecb82213ff10
-
SHA256
ad4e448d25169180137140041da70ba41fcdffe8acad53c668b4d8e0bb2fb905
-
SHA512
e76d4aedfe756024e74d440bcd8102a2ff99227d06f810ff6a99368d0f412b0e95de3baf10cdad81ea7948915f68705b2b724085dc2bb927a5cbe88d08732749
-
SSDEEP
49152:9X5C5WFHzkvvlJ4FDaMDxna3nt9R++3HO:9J+iHzkv9Gz+B+Ou
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-