a7e53f87182e9434e8a3e2f395442fc70ef913d846327978426eb688d48e068a

General

Target
AdamxElite.zip
Size 28.5MB
Sample260817-p8dgxs1blh
SHA256 a7e53f87182e9434e8a3e2f395442fc70ef913d846327978426eb688d48e068a
MD5 99b401ee85895406ec895321a69037a2
SHA1 8f9726a3ffe88ef275cc53b9642cd371eba7b751
SHA512 333245e1a1df55363af8724bcffb6d0eb5c75ae498edf6cb434912e640e5d840e971697fe98c59fc7544a74acb5e266ed2951204da42cf9cf36d92b14e4123bf
SSDEEP 786432:pyVJxiFzjsishQRzyWrQsafZak70JNjT+kJwFMaoritUJMpYx+zC7Vet:Oqpsh8zzCsS0zTrre8OYxmeet
TLSH
T1906733EF85989213E7B8A33881914A971FB7C909CCEDB64F90C7E7B14D428A5C0751EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  AdamxElite/launch.bat
- Size 4KB
- SHA256 4eda0cf9428362f5bd5920d54603843cf512acb340acbb9a7f9b71e11b56fb60
- MD5 5c98d43086c85f59e6bb04758312f66a
- SHA1 4429e7db2279b3e9eb678235e9d65acd880940a0
- SHA512 d13bfe0ea5173a65635c541f5c4a6cbabe277c7c47c53c4f0d2f94bedfbc5b9ddaca340474eed76d7d264886e6a91ff070389ddfb288a72949301d5e5dca9492
- SSDEEP 96:yyqzYrixep58kckMFwJAvW5RaLktBl8raqR:yyprMep58kckYwJAvW5RaLk3l8B
- TLSH
  T12CA19702B314AD3210C161B6DE9B7060B6996E4B03092CCDF1DBA1ED6F1A3D1A6FD4C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  AdamxElite/patched/Adamx Tweaking Utility.exe
- Size 18.6MB
- SHA256 4c7912cb79df3becfb6a7e8a93f2fd338c9128fdd54c25244e932dc205fb5aa0
- MD5 b76013f5c662cc009a3f498a4a3cb0de
- SHA1 4ea1d753f976bdd99c931a4fcb6da3e63762cabc
- SHA512 022156a048d413695b6dde099086fca41a5e762bfa5f879e104c09ea2938db84f5dea9f6b9fd158df0dc76afe084fa606b78de2b8126079d1718e66ea102433a
- SSDEEP 196608:XsahmMk65pQQbs/eQp0+EXKXeXjfMOeqAGMbTn6T:XfkMzQcs/eQp0+EX3jB9Mbj6
- TLSH
  T145177C48B3814EE0E127D338C967D272DB70BE657626832F1965F29B1F3B2904E7A531
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral2
- Target
  AdamxElite/patched/app.js
- Size 379KB
- SHA256 66c48f0147742ba22272b62a6aec32484e46f46a9f6d78ad39ef66a3411d7919
- MD5 19609a3095c4471eac692bc13f2ab054
- SHA1 1a1e229142149769e79632c2a80da5f1a7608f5c
- SHA512 2803d077d5155fff7650ec137af927e5017f4a5003ce28cc34209548d95354e7ffa9e0eb0f9347b9c6297b4bb3ee539f1b96f1a4b3027399780c0e50bd867857
- SSDEEP 3072:zmx6lsdckE6lKbP7mjd8D4R19mDvkLspGXJTQ8+hLfz16y4:Si8jZlKbzqdl9mDv7GXJsDLLUy4
- TLSH
  T140842B567154253A883353B9EB4F2265FB2A8113E20A81147EAD83181F77C68C5BFFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Adamx_Tweaking_Utility-Setup (1).msi
- Size 23.2MB
- SHA256 3fa1323a7c4001c240300f0ca5ef82c05c4af05dc160584149f34c5bb021d5ce
- MD5 da7bb24f3ea8de229232334a078d9e21
- SHA1 a218bac4b5a29884927a0ccd99373d3dde1ffdf5
- SHA512 04f6489cc07e7a12c0dc4d5bf7e5b4f0d1236733f37e165670d81593acb1e271a7f83ad7ce67ff31a35691623910dfe6386990cb8670e918352181189b9b477d
- SSDEEP 393216:jNYsStkgQoG54Izk/5wxSHROsCKTzgZF5+dUI+jh8ddJPYx2IiQPProDAZ1xraGV:GptdQou4KkhwxDUzgZn+L+ji/JAIMPr3
- TLSH
  T1CA371217BE86586AC0DCCD74C27787634A2574D70A2AF6AF01C90519EEFA7F08B193C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery ransomware themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4