General
-
Target
d890e54e56f84854d4daace1ea55ad979191dd02c682dba496a405372dff1882
-
Size
1.8MB
-
Sample
240525-kybhcsce58
-
MD5
7e03538dc25285b705604b2ace4492f0
-
SHA1
2a0a13d5eb4d394c6e18443602879aa428211a50
-
SHA256
d890e54e56f84854d4daace1ea55ad979191dd02c682dba496a405372dff1882
-
SHA512
3ae4641fa4410664041bf7d61565a0959faf42c8e16f8639fb6b65f8e7e2ea679fd28246be905289584fb68ff19266be7f86ddb8e681b4dc929ebc1017b7763c
-
SSDEEP
49152:qefDXocp5mJpuC9tS9SHYg/2o42pL2Sa/F1nw8:qqIcC9tu9g/2o4YL2Sa9+8
Static task
static1
Behavioral task
behavioral1
Sample
d890e54e56f84854d4daace1ea55ad979191dd02c682dba496a405372dff1882.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Targets
-
-
Target
d890e54e56f84854d4daace1ea55ad979191dd02c682dba496a405372dff1882
-
Size
1.8MB
-
MD5
7e03538dc25285b705604b2ace4492f0
-
SHA1
2a0a13d5eb4d394c6e18443602879aa428211a50
-
SHA256
d890e54e56f84854d4daace1ea55ad979191dd02c682dba496a405372dff1882
-
SHA512
3ae4641fa4410664041bf7d61565a0959faf42c8e16f8639fb6b65f8e7e2ea679fd28246be905289584fb68ff19266be7f86ddb8e681b4dc929ebc1017b7763c
-
SSDEEP
49152:qefDXocp5mJpuC9tS9SHYg/2o42pL2Sa/F1nw8:qqIcC9tu9g/2o4YL2Sa9+8
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-