General
-
Target
dfabfe5ff3f2ef676c2a249a1eeb177fb9f70133d9f4d17d2089a823d88665ccN.exe
-
Size
526KB
-
Sample
250216-xfcnxswjaw
-
MD5
256f594357c847885ff90b77faf824d0
-
SHA1
b191c03b58967f8612ac4689c9fbb10f8b3a03c6
-
SHA256
dfabfe5ff3f2ef676c2a249a1eeb177fb9f70133d9f4d17d2089a823d88665cc
-
SHA512
29ca64c4dbfc8ef504ce0f8e66df32fdfea0e227e448fb3b6bd6ecf14a06960cb3df4ada0f7f44a4ecb3ac6e65f0ce324f725648bca94699f284c50d3ff3bfdb
-
SSDEEP
12288:SMrny90okp3rPkhFUCjj1ph5qTE5bsAlV4t//8pLl:py/MQhFUQDqT+C8pLl
Static task
static1
Behavioral task
behavioral1
Sample
dfabfe5ff3f2ef676c2a249a1eeb177fb9f70133d9f4d17d2089a823d88665ccN.exe
Resource
win10v2004-20250207-en
Malware Config
Extracted
amadey
3.66
47d0a3
http://62.204.41.5
-
install_dir
5eb6b96734
-
install_file
mnolyk.exe
-
strings_key
4e2443c99695fdd2c1517b867af1bc22
-
url_paths
/Bu58Ngs/index.php
Targets
-
-
Target
dfabfe5ff3f2ef676c2a249a1eeb177fb9f70133d9f4d17d2089a823d88665ccN.exe
-
Size
526KB
-
MD5
256f594357c847885ff90b77faf824d0
-
SHA1
b191c03b58967f8612ac4689c9fbb10f8b3a03c6
-
SHA256
dfabfe5ff3f2ef676c2a249a1eeb177fb9f70133d9f4d17d2089a823d88665cc
-
SHA512
29ca64c4dbfc8ef504ce0f8e66df32fdfea0e227e448fb3b6bd6ecf14a06960cb3df4ada0f7f44a4ecb3ac6e65f0ce324f725648bca94699f284c50d3ff3bfdb
-
SSDEEP
12288:SMrny90okp3rPkhFUCjj1ph5qTE5bsAlV4t//8pLl:py/MQhFUQDqT+C8pLl
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender notification settings
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Windows security modification
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1