amadey | 5aff860634fadee66a6e8220e67f7ebc88bfcde7a905a2753655706c0252afd1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5aff860634fadee66a6e8220e67f7ebc88bfcde7a905a2753655706c0252afd1
Size

67KB
MD5

dab5ac9b02e0cd7120f54a5609a8aee0
SHA1

47d508731d005ee56b27f0da5ee266d79c0643b2
SHA256

d9ae528ca7df72274df3f114f07a77d89f32cd73288a55b963961227a0acac80
SHA512

af28a48b7bf3339c791b5be2ead3525191e2e1699e723523100254befe1eb44aeabd655c674ae6923efec8af43c2be973372dd1b0eafaacdb6c9d0b61e4609d2
SSDEEP

1536:zlydJqpkUTl5tWf7iC0xmXN/MVvVCtt75ZIh7hrtkHunr:zogkM6B0xm9OUtPuHSOr

Score

10^/10

amadey

Malware Config

Signatures

Amadey family
amadey

Detect Amadey credential stealer module 1 IoCs

resource	yara_rule
static1/unpack001/5aff860634fadee66a6e8220e67f7ebc88bfcde7a905a2753655706c0252afd1	amadey_cred_module

Files

5aff860634fadee66a6e8220e67f7ebc88bfcde7a905a2753655706c0252afd1
.zip
5aff860634fadee66a6e8220e67f7ebc88bfcde7a905a2753655706c0252afd1
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

Main
Save

Sections

CODE
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 79B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ