Behavioral task
behavioral1
Sample
968-61-0x0000000000400000-0x000000000065B000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
968-61-0x0000000000400000-0x000000000065B000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
968-61-0x0000000000400000-0x000000000065B000-memory.dmp
-
Size
2.4MB
-
MD5
80fd4fc9ebf8234cad7ae6d6f2e7b0cd
-
SHA1
a623606c6766f9b7daf6e8f9c0a31182905ed711
-
SHA256
00cb407031439b34bd6f43fc0c452e64c985182529d9002ed50f5d2a85f3b191
-
SHA512
1e2190dc658b241c61fa020c419b6538e6d297354732cdee98b786b00840a0ef294a64318c8b804ad48f368cc04c31b1e4c997e31a1ff4222a01d74d06aba750
-
SSDEEP
6144:c5dzwO5jJFSIijqVSS8LfZujp8DqFRlpUu:cZkqx8Nujp+qF9Uu
Malware Config
Extracted
amadey
3.50
193.56.146.194/h49vlBP/index.php
Signatures
-
Amadey family
Files
-
968-61-0x0000000000400000-0x000000000065B000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ