General
-
Target
6e0563352d79e8e841c8469f90bc90eba202d8466de5080b1fde9d6b0c19de7fN.exe
-
Size
2.9MB
-
Sample
241217-2gv9wa1jdy
-
MD5
fdf59cbf8f04f400aee5653fe6469240
-
SHA1
a8425dc088a6a3dc9105d0906950d2529a3a35bb
-
SHA256
6e0563352d79e8e841c8469f90bc90eba202d8466de5080b1fde9d6b0c19de7f
-
SHA512
e9114e83e60e76839cf9c188223ef25e0130526843f12a20e672e899414ca4e256a55d4779cf74063542103635854944cb46adb9a923f471a76d6ef0606cefd6
-
SSDEEP
49152:DUWQgGR/9Z17uMskkSaFOaStGdSPOSrsusPrsCSXR1V:DUl9Z175skkS+OamGqbVarmBf
Static task
static1
Behavioral task
behavioral1
Sample
6e0563352d79e8e841c8469f90bc90eba202d8466de5080b1fde9d6b0c19de7fN.exe
Resource
win7-20240903-en
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
Extracted
cryptbot
Targets
-
-
Target
6e0563352d79e8e841c8469f90bc90eba202d8466de5080b1fde9d6b0c19de7fN.exe
-
Size
2.9MB
-
MD5
fdf59cbf8f04f400aee5653fe6469240
-
SHA1
a8425dc088a6a3dc9105d0906950d2529a3a35bb
-
SHA256
6e0563352d79e8e841c8469f90bc90eba202d8466de5080b1fde9d6b0c19de7f
-
SHA512
e9114e83e60e76839cf9c188223ef25e0130526843f12a20e672e899414ca4e256a55d4779cf74063542103635854944cb46adb9a923f471a76d6ef0606cefd6
-
SSDEEP
49152:DUWQgGR/9Z17uMskkSaFOaStGdSPOSrsusPrsCSXR1V:DUl9Z175skkS+OamGqbVarmBf
-
Amadey family
-
Cryptbot family
-
Lumma family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
3