Static task
static1
Behavioral task
behavioral1
Sample
5100-169-0x0000000000400000-0x0000000000A84000-memory.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5100-169-0x0000000000400000-0x0000000000A84000-memory.exe
Resource
win10v2004-20220414-en
General
-
Target
5100-169-0x0000000000400000-0x0000000000A84000-memory.dmp
-
Size
6.5MB
-
MD5
00fc8b1c7f2ab612ddedc0cfc1217009
-
SHA1
2f8fa0fce605e48ec1145167c5e67863ab567663
-
SHA256
42a3c4b4ac51d0f7a88957f823ead9970dc34e54516e10a13541c44a444290c4
-
SHA512
30c2072d8da6ae6c421eec5c2a16cca059b4a28d71eae61dea2d68d62ac29ebf9f97396d543c10c2b288b10fa308b5452f62af0491064c0f899b2074955da134
-
SSDEEP
6144:R/D1GHgyYjyNnqxJWM0tQ6y7V0nmtCuCcP2M5Ez8i2+M:RyYjyVqxJWM6e7OnmtCuCcP2Mfi2+
Malware Config
Extracted
amadey
3.21
185.215.113.15/Lkb2dxj3/index.php
Signatures
-
Amadey family
Files
-
5100-169-0x0000000000400000-0x0000000000A84000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 199KB - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ