General
-
Target
JaffaCakes118_cb5b534f0189a845cb43ea11408e4390f3b036d447c3ceedd337c2c88af0cc4c
-
Size
666.4MB
-
Sample
241225-sa9dgswlcr
-
MD5
17ad61a9214cd9e9e45b384f60e72080
-
SHA1
b71c00ef2cd78c49290794757ea4c55dfbfe876d
-
SHA256
cb5b534f0189a845cb43ea11408e4390f3b036d447c3ceedd337c2c88af0cc4c
-
SHA512
5463ab150cb38e0a10a4817adc56ebbcee44da598083d6cb1f1fc46b4448ba5b5c941318c0edd20be97108ac528c93bc97024622cb471d4cd3567fdd824af1ab
-
SSDEEP
393216:05JZmjg+j9etHB77rUdzJauPPEj8SqEHZp+4/HSfmxhpKtMagDQ79Vh9XzqhTJe:QmvpX
Static task
static1
Behavioral task
behavioral1
Sample
Spotify Premium/Setup.exe
Resource
win7-20241010-en
Malware Config
Extracted
amadey
3.80
563433
http://31.41.244.146
-
install_dir
23e20ad4db
-
install_file
oneetx.exe
-
strings_key
3d2ec53af224847a59d1d611532d52aa
-
url_paths
/u83mfdS2/index.php
Targets
-
-
Target
Spotify Premium/Setup.exe
-
Size
630.2MB
-
MD5
32a4d0a4ab16a702c4a00b41a6d1377e
-
SHA1
cf9935a37c5477fdd991f50078d0fbe0da51f8df
-
SHA256
6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf
-
SHA512
c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf
-
SSDEEP
6144:TfbOrBANQk+LQ9JfIzgPO6gsURuloFxdPQ:MO//AzgmuqO
-
Amadey family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-