General
-
Target
16d8b5779b73b471fa2b8044a1ccd29d741400c0da85b2759aec997271c63f0c
-
Size
1.7MB
-
Sample
240523-2pzx2aca7x
-
MD5
9d70e810f650c3449f9c61ff47941c57
-
SHA1
251bfa2c3b1e99c5f346e759f7cfb7e8b84af5fd
-
SHA256
16d8b5779b73b471fa2b8044a1ccd29d741400c0da85b2759aec997271c63f0c
-
SHA512
82ab71054558f837f6a7104061827a86152c9addaaa682a0300afa5fd22187f60c434d93aa2e90d6a7f6bc298b89667201e1feaf3a5c72aec9f1c7ff5b01e044
-
SSDEEP
49152:EIY1myiLCGzCLyVSAEt4owekvt+xyHdqT3pK:EB1mnm0CBAEWwQB9qTZK
Behavioral task
behavioral1
Sample
16d8b5779b73b471fa2b8044a1ccd29d741400c0da85b2759aec997271c63f0c.exe
Resource
win7-20240215-en
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Targets
-
-
Target
16d8b5779b73b471fa2b8044a1ccd29d741400c0da85b2759aec997271c63f0c
-
Size
1.7MB
-
MD5
9d70e810f650c3449f9c61ff47941c57
-
SHA1
251bfa2c3b1e99c5f346e759f7cfb7e8b84af5fd
-
SHA256
16d8b5779b73b471fa2b8044a1ccd29d741400c0da85b2759aec997271c63f0c
-
SHA512
82ab71054558f837f6a7104061827a86152c9addaaa682a0300afa5fd22187f60c434d93aa2e90d6a7f6bc298b89667201e1feaf3a5c72aec9f1c7ff5b01e044
-
SSDEEP
49152:EIY1myiLCGzCLyVSAEt4owekvt+xyHdqT3pK:EB1mnm0CBAEWwQB9qTZK
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-