General
-
Target
c507f450ad1b6173f54279f63f93d878545560bd234a19acb442a22a40d9e28b
-
Size
2.8MB
-
Sample
241216-rkpamasma1
-
MD5
62cfbf48cbec19b909d15fc91d70cb47
-
SHA1
1c900301e2fa4b10cc69fb53c160f27254c607c6
-
SHA256
c507f450ad1b6173f54279f63f93d878545560bd234a19acb442a22a40d9e28b
-
SHA512
952f885a05b2474d76cf53607323c06646908470bf30770f2c639c5440421b1ad8c8a130807b0ad38ca88267dff2d52cbdc790aaff827b8e422d04b2148e878c
-
SSDEEP
49152:2r4wwAxziwgFtvyMcy4MmjQfcMIQVzhzsSWSbnDBQkk:2r7wOefvyMc1MmUflFWSbnDBQkk
Static task
static1
Behavioral task
behavioral1
Sample
c507f450ad1b6173f54279f63f93d878545560bd234a19acb442a22a40d9e28b.exe
Resource
win7-20241010-en
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
smokeloader
pub3
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://shineugler.biz/api
Extracted
lumma
https://shineugler.biz/api
Targets
-
-
Target
c507f450ad1b6173f54279f63f93d878545560bd234a19acb442a22a40d9e28b
-
Size
2.8MB
-
MD5
62cfbf48cbec19b909d15fc91d70cb47
-
SHA1
1c900301e2fa4b10cc69fb53c160f27254c607c6
-
SHA256
c507f450ad1b6173f54279f63f93d878545560bd234a19acb442a22a40d9e28b
-
SHA512
952f885a05b2474d76cf53607323c06646908470bf30770f2c639c5440421b1ad8c8a130807b0ad38ca88267dff2d52cbdc790aaff827b8e422d04b2148e878c
-
SSDEEP
49152:2r4wwAxziwgFtvyMcy4MmjQfcMIQVzhzsSWSbnDBQkk:2r7wOefvyMc1MmUflFWSbnDBQkk
-
Amadey family
-
Lumma family
-
Smokeloader family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3