General
-
Target
04b05d72679b657e55f0bc84630320a87f1830df3989b8b2d3330358969b6472
-
Size
1.8MB
-
Sample
240428-kc797sbh61
-
MD5
55027c84a3fa77944f2b617a805398e6
-
SHA1
9eb4a5bab2b04958ed519d9d5c0c7f9a02c7a2be
-
SHA256
04b05d72679b657e55f0bc84630320a87f1830df3989b8b2d3330358969b6472
-
SHA512
63d066efa2ac2fc2dc0cce3fd90e46327b930abeab8751e1b81f511420680a9c6644e594d41970b19f67f93e612205aef65d620360f5744a31dba3adfaf94222
-
SSDEEP
24576:IcSXFq/Vn7sCodi6zSjAHwgQzPHrICGWl7019kqiXpkWHQIvlKL7/4WwQED1wSPx:oTyjdbLICGWl7017fXIgQW01zMwO8TX
Static task
static1
Behavioral task
behavioral1
Sample
04b05d72679b657e55f0bc84630320a87f1830df3989b8b2d3330358969b6472.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Targets
-
-
Target
04b05d72679b657e55f0bc84630320a87f1830df3989b8b2d3330358969b6472
-
Size
1.8MB
-
MD5
55027c84a3fa77944f2b617a805398e6
-
SHA1
9eb4a5bab2b04958ed519d9d5c0c7f9a02c7a2be
-
SHA256
04b05d72679b657e55f0bc84630320a87f1830df3989b8b2d3330358969b6472
-
SHA512
63d066efa2ac2fc2dc0cce3fd90e46327b930abeab8751e1b81f511420680a9c6644e594d41970b19f67f93e612205aef65d620360f5744a31dba3adfaf94222
-
SSDEEP
24576:IcSXFq/Vn7sCodi6zSjAHwgQzPHrICGWl7019kqiXpkWHQIvlKL7/4WwQED1wSPx:oTyjdbLICGWl7017fXIgQW01zMwO8TX
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-