General
-
Target
f39dac3f671d9fa00ce441585ecc355014a9f63ae15652efa454b8636198e193
-
Size
4.0MB
-
Sample
241112-rxxsjavcph
-
MD5
4821bd4f04f2d9ca7249e79fd963725d
-
SHA1
92cd5261447dd865822da3620102db9fd84554b0
-
SHA256
f39dac3f671d9fa00ce441585ecc355014a9f63ae15652efa454b8636198e193
-
SHA512
8f75a29af6cc1d9f9f1e96cfc1acae9779a726c37762c576492609fd52f404b16d6d7bbf927c5f29805d32d345e766ce69fc6fe0fee0bd37edc98e5b60c083ff
-
SSDEEP
98304:hamyLDIplFDBlFfp9LNnzABkP7Q4sPaD3EoSfIfccK0p76:IoDfFfp9hz4Woaz7hc
Static task
static1
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Targets
-
-
Target
f39dac3f671d9fa00ce441585ecc355014a9f63ae15652efa454b8636198e193
-
Size
4.0MB
-
MD5
4821bd4f04f2d9ca7249e79fd963725d
-
SHA1
92cd5261447dd865822da3620102db9fd84554b0
-
SHA256
f39dac3f671d9fa00ce441585ecc355014a9f63ae15652efa454b8636198e193
-
SHA512
8f75a29af6cc1d9f9f1e96cfc1acae9779a726c37762c576492609fd52f404b16d6d7bbf927c5f29805d32d345e766ce69fc6fe0fee0bd37edc98e5b60c083ff
-
SSDEEP
98304:hamyLDIplFDBlFfp9LNnzABkP7Q4sPaD3EoSfIfccK0p76:IoDfFfp9hz4Woaz7hc
-
Amadey family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2