amadey | 8627196347[.]zip

Sharing

Target
8627196347.zip
Size 4.5MB
Sample221222-rdpmtaee89
SHA256 871ae5b567e478dd9a5f3601f24758d1315f38b659497a9bda3c701776fc8409
MD5 8a5b99511113960d4c4b59b1fc592352
SHA1 e3f38b068b957b17830049036e0018b7bafc036f
SHA512 b62b9afa58139e46c8c1feec155122d3bc1dca6909c11b6d1012825352ce5ad7095c06f6f0511d1cd105d7d64fb414b3f7947801b91a4a06b295a10ec3926219
SSDEEP 98304:EPkRs3h5oKAcTeBNwFTUhlWxXNwBuFkTtkCSTqh/jz5NSTdT+X4hnI:nUh5UFBUYhlMo+E5HSTZ+X42
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detect Amadey credential stealer module 1 IoCs

resource	yara_rule
static1/unpack001/469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65	amadey_cred_module

Detected Mount Locker ransomware 1 IoCs

resource	yara_rule
static1/unpack001/469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65	RANSOM_mountlocker

Detected SUNBURST backdoor 1 IoCs

SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

resource	yara_rule
static1/unpack001/469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65	family_sunburst

GandCrab payload 1 IoCs

resource	yara_rule
static1/unpack001/469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65	family_gandcrab

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
static1/unpack001/469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65	xmrig

SHA256 871ae5b567e478dd9a5f3601f24758d1315f38b659497a9bda3c701776fc8409
MD5 8a5b99511113960d4c4b59b1fc592352
SHA1 e3f38b068b957b17830049036e0018b7bafc036f
SHA512 b62b9afa58139e46c8c1feec155122d3bc1dca6909c11b6d1012825352ce5ad7095c06f6f0511d1cd105d7d64fb414b3f7947801b91a4a06b295a10ec3926219
SSDEEP 98304:EPkRs3h5oKAcTeBNwFTUhlWxXNwBuFkTtkCSTqh/jz5NSTdT+X4hnI:nUh5UFBUYhlMo+E5HSTZ+X42
MD5 SHA1 SHA512 SSDEEP

Password

infected

SHA256 469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65
MD5 d6340fd7927ba1ecc8b8dca640cc7998
SHA1 fd6570f966b3b39ee7664336ae8a4d12c9a8d414
SHA512 b9000ca6fa9f3ee9c0ddac05569d8f881c95217baf2fe730f94e140dfecf438fe6c35f148ae910a3175e524a673fefc17a25c6e71aeb94a627f78fd3399ba3fc
SSDEEP 49152:8SFvrQJFY83N4qsYiGsiEnaZQTCBjDpN+v0Bkl7CqfaJDJk/SET9y2zkp:5cJ12xG8a+TWPpNG669DQp
MD5 SHA1 SHA512 SSDEEP

windows x86

Detect Amadey credential stealer module
Detected Mount Locker ransomware
Detected SUNBURST backdoor

SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

backdoor
GandCrab payload
XMRig Miner payload

miner

Minor OS version

Major OS version

Entry point

25991

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths