General
-
Target
2a7137.exe
-
Size
3.2MB
-
Sample
250801-11dcqsgm8y
-
MD5
036c6e4034e9bc73eb810ef8a4930a0e
-
SHA1
a4f84a698f138da147df807471d31aa0b828558a
-
SHA256
a721adbf3235af51e880c8c51fb1a7dded95a6ba579986d8dcd350a3cb96bb11
-
SHA512
611bff8fc4d3e25015999ba702cc200b96c9ff4c04572db36a9bd5a4c6eec1f4c4f4df702879f516213e694a41e702e4892c763e1cde661de520c405bb166494
-
SSDEEP
98304:FtwFyT3R6HSEFEU/OyaWHACRWsKNpuZKqdgd:jwk0SCPOyakUpuZVdgd
Static task
static1
Behavioral task
behavioral1
Sample
2a7137.exe
Resource
win10v2004-20250610-en
Malware Config
Extracted
amadey
5.55
fbf543
http://94.154.35.25
-
install_dir
96a319e745
-
install_file
Srxelqcif.exe
-
strings_key
f8bfac017914b836f3106c5bcd0878fe
-
url_paths
/di9ku38f/index.php
Extracted
xworm
5.0
hexa.dnsframe.com:66
FzSIsfqlHwWWhS56
-
Install_directory
%AppData%
-
install_file
inj.exe
Extracted
lumma
https://bittsgly.my/atop/api
https://mastwin.in/qsaz/api
https://precisionbiomeds.com/ikg
https://physicianusepeptides.com/opu
https://vishneviyjazz.ru/neco/api
https://htsfhtdrjbyy1bgxbv.cfd/vcd
https://xurekodip.com/qpdl
https://utvp1.net/zkaj
https://orienderi.com/xori
https://mocadia.com/iuew
https://t.me/reusmey
https://nucleji.my/ituw/api
https://t.me/RONALDOORMESSSSI
https://dravq.asia/wixj/api
https://cezgroup.contact/xlak/api
https://stockwises.eu/xiut/api
-
build_id
666f9f2558e7e58c2a44871f881c1e25f2b0
Extracted
cyber_stealer
https://paxrobot.digital/webpanel/
-
pastebin
https://pastebin.com/raw/6K66Aeyr
Extracted
gcleaner
185.156.73.98
45.91.200.135
Targets
-
-
Target
2a7137.exe
-
Size
3.2MB
-
MD5
036c6e4034e9bc73eb810ef8a4930a0e
-
SHA1
a4f84a698f138da147df807471d31aa0b828558a
-
SHA256
a721adbf3235af51e880c8c51fb1a7dded95a6ba579986d8dcd350a3cb96bb11
-
SHA512
611bff8fc4d3e25015999ba702cc200b96c9ff4c04572db36a9bd5a4c6eec1f4c4f4df702879f516213e694a41e702e4892c763e1cde661de520c405bb166494
-
SSDEEP
98304:FtwFyT3R6HSEFEU/OyaWHACRWsKNpuZKqdgd:jwk0SCPOyakUpuZVdgd
-
Amadey family
-
Cyber_stealer family
-
Detect Vidar Stealer
-
Detect Xworm Payload
-
Detects CyberStealer
-
Detects DonutLoader
-
Disables service(s)
-
DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Donutloader family
-
Gcleaner family
-
Lumma family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Vidar family
-
Xworm family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Sets service image path in registry
-
Stops running service(s)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Modify Registry
3Obfuscated Files or Information
1Command Obfuscation
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
9Remote System Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2