Behavioral task
behavioral1
Sample
2000-58-0x0000000000400000-0x0000000000A89000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2000-58-0x0000000000400000-0x0000000000A89000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2000-58-0x0000000000400000-0x0000000000A89000-memory.dmp
-
Size
6.5MB
-
MD5
27f7d2f28a0b827362ed231b0c0f7f39
-
SHA1
cf5ad4ccd370b1b065ad60dda95f77d5c046f9ab
-
SHA256
71ca5cfe77473b08b676c44992ffa94da9071121084e8592a15414a34a2b4ba5
-
SHA512
6ae21eb92f8cebb9e625c54f68506cc1366079f687dafab680effe77d60a7884956fdd71570040015e60f17ec416dc835cc115ea432c9c09079f3b0fabbbe9b8
-
SSDEEP
12288:FyYjyVqxJWM6e7OnmtCuCcP2wdzvlJcA:XjyVqDD7Ouvx
Malware Config
Extracted
amadey
3.21
185.215.113.204/Lkb2dxj3/index.php
Signatures
-
Amadey family
Files
-
2000-58-0x0000000000400000-0x0000000000A89000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 199KB - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ