amadey | 369321f33d5ffaeeadb4da9f33c78156[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
369321f33d5ffaeeadb4da9f33c78156.exe
Size 241KB
Sample221207-ta3flsad91
SHA256 5c5db333e1a7ce5e55ffa3aca2858d8e431e6e1fc0dae0ca508c6081819828dd
MD5 369321f33d5ffaeeadb4da9f33c78156
SHA1 fe82623db9ce76ab210c510ac969add839795612
SHA512 635df1c74d13a2de4021e9700296e2d367ccc3cf89bbb2923e8a874c46324742ec077a9958dee6a13b336a75ff6d44271f109c66b70f00d0ffd3cc7a0d0ed5f7
SSDEEP 6144:nlvsfCqKGsJzgVvk/JUfL6pWnqujpiBLI89Xu:lkKpJI6pFujpiVFu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey

Malware Config

Extracted

Family

amadey

Version

3.50

31.41.244.237/jg94cVd30f/index.php

Signatures

Amadey family
amadey

File Explorer

369321f33d5ffaeeadb4da9f33c78156.exe

.exe 241KB

369321f33d5ffaeeadb4da9f33c78156.exe

IMPHASH 857774b8dd5bc6abe25ef09f890c7f72
SHA256 5c5db333e1a7ce5e55ffa3aca2858d8e431e6e1fc0dae0ca508c6081819828dd
MD5 369321f33d5ffaeeadb4da9f33c78156
SHA1 fe82623db9ce76ab210c510ac969add839795612
SHA512 635df1c74d13a2de4021e9700296e2d367ccc3cf89bbb2923e8a874c46324742ec077a9958dee6a13b336a75ff6d44271f109c66b70f00d0ffd3cc7a0d0ed5f7
SSDEEP 6144:nlvsfCqKGsJzgVvk/JUfL6pWnqujpiBLI89Xu:lkKpJI6pFujpiVFu
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

100672

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA GetLastError GetFileAttributesA CreateFileA CloseHandle GetSystemInfo CreateThread HeapAlloc GetThreadContext GetProcAddress VirtualAllocEx GetTempPathA RemoveDirectoryA ReadProcessMemory GetProcessHeap CreateProcessA CreateDirectoryA SetThreadContext WriteConsoleW ReadConsoleW SetEndOfFile HeapReAlloc HeapSize Sleep SetCurrentDirectoryA GetModuleHandleA ResumeThread SuspendThread GetComputerNameExW GetVersionExW CreateMutexW VirtualAlloc WriteFile VirtualFree HeapFree WriteProcessMemory GetModuleFileNameA LocalFree ReadFile SetFilePointerEx GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW MultiByteToWideChar CompareStringW LCMapStringW

user32

GetSystemMetrics ReleaseDC GetDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

RegCloseKey RegGetValueA RegQueryValueExA GetUserNameA RegSetValueExA RegOpenKeyExA ConvertSidToStringSidW GetUserNameW LookupAccountNameW

shell32

ShellExecuteA ord680 SHGetFolderPathA

wininet

HttpOpenRequestA InternetOpenUrlW InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpAddRequestHeadersA HttpSendRequestExW HttpEndRequestA InternetOpenW InternetOpenUrlA InternetWriteFile

gdiplus

GdipSaveImageToFile GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdiplusShutdown GdiplusStartup