Behavioral task
behavioral1
Sample
4156-143-0x0000000000400000-0x00000000004C2000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4156-143-0x0000000000400000-0x00000000004C2000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4156-143-0x0000000000400000-0x00000000004C2000-memory.dmp
-
Size
776KB
-
MD5
531dfaee84923fa665391dc1c842c880
-
SHA1
8df9970055c44b935723bb711e38e2f733b6fbeb
-
SHA256
5bd5d2b6aa94bc57300e35f8a1d8fecad4fcc15edc56641061fe63931c27dca4
-
SHA512
adbf35173a747f8b9c676167376ec8e1c6392ec41334f484b58cefad9a2e499f646ed398d355465704cb424c9986003e0722c60778cc122695d706a485e2bbab
-
SSDEEP
12288:KZkqx8Nujp+qT1uFMNCjm+pH6Dxh8Dbn5gCj91NjwNa7/EBjz0o4c:KZkPjqRu+ELCxeDbn5fj91NjjzU0o4
Malware Config
Extracted
amadey
3.50
77.73.134.65/o7VsjdSa2f/index.php
Signatures
-
Amadey family
Files
-
4156-143-0x0000000000400000-0x00000000004C2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ