General
-
Target
1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe
-
Size
578KB
-
Sample
241112-pbdres1ndz
-
MD5
3c8c7a7204f2526c0c40f8b929d52506
-
SHA1
478d3bbf33a4c2d2d5e545a31084307f7595d871
-
SHA256
1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023
-
SHA512
36fcf91c5e922e29baaca9bebda225fe0dba603e22955bf0f4c29aee69d8320f72cc79864a546b88c4a29e89190eaf8425c7cc8938631d5377ef7fc7d7bd7404
-
SSDEEP
12288:gy90PcjI+Hdubtp1rGXA6Vmp79TAVlSusoKG:gyTEY+1rGXACIAVRsoKG
Static task
static1
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Targets
-
-
Target
1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023.exe
-
Size
578KB
-
MD5
3c8c7a7204f2526c0c40f8b929d52506
-
SHA1
478d3bbf33a4c2d2d5e545a31084307f7595d871
-
SHA256
1ed1e24c2a8e4465170ea4ee9ec9c2271a486d1bc6bde20f0d74c1371fb01023
-
SHA512
36fcf91c5e922e29baaca9bebda225fe0dba603e22955bf0f4c29aee69d8320f72cc79864a546b88c4a29e89190eaf8425c7cc8938631d5377ef7fc7d7bd7404
-
SSDEEP
12288:gy90PcjI+Hdubtp1rGXA6Vmp79TAVlSusoKG:gyTEY+1rGXACIAVRsoKG
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1