Behavioral task
behavioral1
Sample
4752-137-0x0000000001000000-0x0000000001041000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4752-137-0x0000000001000000-0x0000000001041000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
4752-137-0x0000000001000000-0x0000000001041000-memory.dmp
-
Size
260KB
-
MD5
cd9071060e11806fc81840a5b88b3162
-
SHA1
79c0bf11fd1c36e95a81a2a0327b8c8567db07a4
-
SHA256
75ca3fa3aa8351099820e3db77feefd93a48c86566331a82ec3669f12a109ba2
-
SHA512
619c1503d47016613aab955a98b37954f2de5040c8f63395dfafde39ea4ebce6df9fc98f16eb3784fe02f9b98da54b4e910957bebaf47c8feb532578319437d7
-
SSDEEP
6144:oPQII2XSNEMySRiAiLcfwRh52gZuWBQ+D16q:GAoSwck55uWBQc
Malware Config
Extracted
amadey
3.66
5.75.139.35/so57Nst/index.php
Signatures
-
Amadey family
Files
-
4752-137-0x0000000001000000-0x0000000001041000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ