Behavioral task
behavioral1
Sample
4376-134-0x0000000000400000-0x000000000071A000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4376-134-0x0000000000400000-0x000000000071A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
4376-134-0x0000000000400000-0x000000000071A000-memory.dmp
-
Size
3.1MB
-
MD5
2bb48dc855c7a3c652afce28c134541a
-
SHA1
418d890b80a6a8dd2f70e39e980ae4b64e65fbca
-
SHA256
c761090c1d140c18e8a7dbba86b1d27488152ed7d4c0a039591c971e3a482b5a
-
SHA512
570b5a9cf6ebc45d4dd9e6f429c5fbba450e674a91286d5f3ed996c9062be3d3dff364ff32c71fac4c20dbae9eaf295f2a7609e7b6494f77de849d469e2aa5ac
-
SSDEEP
6144:lBizIWRzBlSIiLaliSMrf5ujpmzqe658tdSq:lasaxMNujpcqe6WS
Malware Config
Extracted
amadey
3.50
31.41.244.17/hfk3vK9/index.php
Signatures
-
Amadey family
Files
-
4376-134-0x0000000000400000-0x000000000071A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ