General
-
Target
cb78a105dec7d748aae5bc3b9c2c3a3233d70f932fd54c29a2a24d36982c6017
-
Size
1.8MB
-
Sample
240702-zseedsyfnb
-
MD5
55e45ab3a8d645849216bf38e6b74b2a
-
SHA1
c0c102c2053e1e53d03cb4b76aac1a12e2d54c15
-
SHA256
cb78a105dec7d748aae5bc3b9c2c3a3233d70f932fd54c29a2a24d36982c6017
-
SHA512
97529b0374ae8375555ae3e4178ef65caed8cd41989e8f05a5e26756e379149953acb3e65335dca901f431e27b79246eeaa2aaa637dc26ae4c8ab7d3c3e4bf76
-
SSDEEP
49152:6TcBVj8d9o2Rfm2Zg38tcKnArtO0ZUahgn4CJvUOE8TkSkrG+Vqp:9BVIQuf2MtcKnArZfI4gvUOE+ks+V6
Static task
static1
Behavioral task
behavioral1
Sample
cb78a105dec7d748aae5bc3b9c2c3a3233d70f932fd54c29a2a24d36982c6017.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
amadey
4.30
4dd39d
http://77.91.77.82
-
install_dir
ad40971b6b
-
install_file
explorti.exe
-
strings_key
a434973ad22def7137dbb5e059b7081e
-
url_paths
/Hun4Ko/index.php
Extracted
stealc
jony
http://85.28.47.4
-
url_path
/920475a59bac849d.php
Targets
-
-
Target
cb78a105dec7d748aae5bc3b9c2c3a3233d70f932fd54c29a2a24d36982c6017
-
Size
1.8MB
-
MD5
55e45ab3a8d645849216bf38e6b74b2a
-
SHA1
c0c102c2053e1e53d03cb4b76aac1a12e2d54c15
-
SHA256
cb78a105dec7d748aae5bc3b9c2c3a3233d70f932fd54c29a2a24d36982c6017
-
SHA512
97529b0374ae8375555ae3e4178ef65caed8cd41989e8f05a5e26756e379149953acb3e65335dca901f431e27b79246eeaa2aaa637dc26ae4c8ab7d3c3e4bf76
-
SSDEEP
49152:6TcBVj8d9o2Rfm2Zg38tcKnArtO0ZUahgn4CJvUOE8TkSkrG+Vqp:9BVIQuf2MtcKnArZfI4gvUOE+ks+V6
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-