General
-
Target
1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8
-
Size
1.8MB
-
Sample
240912-2f46dsyhqh
-
MD5
bef90e67c56413d8e7a94cbd45f9b9a1
-
SHA1
dfc9e49ea097f1955e5830055a7c685d76c6d0d1
-
SHA256
1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8
-
SHA512
ae647a17eafe300f4a465eeda4de2e3b936f39cbbf44a01b1036e5c18c3b40a2cc89e55a4ee0fbc880bafacca1f8781d10b317f187303076038a237aa85bc07d
-
SSDEEP
49152:35PdZAEA9WhDIYXzwQhkeJQxyPE1aCJbz:35FZAP6pzwQ/QtoCJ3
Static task
static1
Behavioral task
behavioral1
Sample
1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8.exe
Resource
win7-20240704-en
Malware Config
Extracted
amadey
4.41
c7817d
http://31.41.244.10
-
install_dir
0e8d0864aa
-
install_file
svoutse.exe
-
strings_key
5481b88a6ef75bcf21333988a4e47048
-
url_paths
/Dem7kTu/index.php
Extracted
stealc
rave
http://185.215.113.103
-
url_path
/e2b1563c6670f193.php
Targets
-
-
Target
1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8
-
Size
1.8MB
-
MD5
bef90e67c56413d8e7a94cbd45f9b9a1
-
SHA1
dfc9e49ea097f1955e5830055a7c685d76c6d0d1
-
SHA256
1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8
-
SHA512
ae647a17eafe300f4a465eeda4de2e3b936f39cbbf44a01b1036e5c18c3b40a2cc89e55a4ee0fbc880bafacca1f8781d10b317f187303076038a237aa85bc07d
-
SSDEEP
49152:35PdZAEA9WhDIYXzwQhkeJQxyPE1aCJbz:35FZAP6pzwQ/QtoCJ3
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-