Behavioral task
behavioral1
Sample
2060-160-0x0000000000400000-0x00000000004C2000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2060-160-0x0000000000400000-0x00000000004C2000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2060-160-0x0000000000400000-0x00000000004C2000-memory.dmp
-
Size
776KB
-
MD5
db50fd7e5e231ee0d4e5cf1e0a249899
-
SHA1
8ca3b52c1d49399e4516b7d0bbc4ae6654bf31d5
-
SHA256
b49b53401c70caa5aa62ca18abe6fecf11e1f6961e4f2e165f3d09b8002997a9
-
SHA512
3915d297013e1e608d2541d9925ee00ae9512a434231d1e951ab2bdfdf1d3ca454759302778c0015686c0e4f77012ec6f3caca4e8df9fb004d6ba2571a68e14f
-
SSDEEP
12288:KZkqx8Nujp+qkOuFMNCjm+I6DYi8Dbn5gCj91NjwNa7/EBjz0o4c:KZkPjqPu+ESCYTDbn5fj91NjjzU0o4
Malware Config
Extracted
amadey
3.50
77.73.134.65/o7VsjdSa2f/index.php
Signatures
-
Amadey family
Files
-
2060-160-0x0000000000400000-0x00000000004C2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ