General
-
Target
file.exe
-
Size
2.8MB
-
Sample
241023-pv6xbasdjk
-
MD5
7e8f2b155ad2523c4f6d8099bc59dca1
-
SHA1
b25ad7de030c34e10808888e1a8e9b82fb40ea10
-
SHA256
ad27642caa9ccf53582f5a9b49538b71e41aff847cc09acf24418f72e4948641
-
SHA512
69f1b6d5f29efc3030bf222948996cce772a75a59b98ca4836c7b8e595dd1e622ca43a0a6cfcb893f7d8f0b953e0ad26e5690dbe33c9c01a5956a0537f12108a
-
SSDEEP
24576:vVo6YZDys0fiiKPdZE0WQ3ec8hM0GSwFY3dKY8n74RWO2wbKvOlpZx18HhEWvjSO:dohbqK8WFY3dKrn7GpKvOlpR78D46o
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://clearancek.site
https://licendfilteo.site
https://spirittunek.store
https://bathdoomgaz.store
https://studennotediw.store
https://dissapoiznw.store
https://eaglepawnoy.store
https://mobbipenju.store
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
doma
http://185.215.113.37
-
url_path
/e2b1563c6670f193.php
Targets
-
-
Target
file.exe
-
Size
2.8MB
-
MD5
7e8f2b155ad2523c4f6d8099bc59dca1
-
SHA1
b25ad7de030c34e10808888e1a8e9b82fb40ea10
-
SHA256
ad27642caa9ccf53582f5a9b49538b71e41aff847cc09acf24418f72e4948641
-
SHA512
69f1b6d5f29efc3030bf222948996cce772a75a59b98ca4836c7b8e595dd1e622ca43a0a6cfcb893f7d8f0b953e0ad26e5690dbe33c9c01a5956a0537f12108a
-
SSDEEP
24576:vVo6YZDys0fiiKPdZE0WQ3ec8hM0GSwFY3dKY8n74RWO2wbKvOlpZx18HhEWvjSO:dohbqK8WFY3dKrn7GpKvOlpR78D46o
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2