amadey | tmp | Triage™

General

Target
tmp
Size 227KB
Sample230301-lcbrnsfb4x
SHA256 3f3dadd2a5177fb918eabacc6a433d46f1975dd9c18cc0a7b63e09669625b800
MD5 17a8f85f937d8106c020a366d7c6ccb4
SHA1 43ef57b2adf9115c51041b5baba5a1565501b1a1
SHA512 ca6e62269cb5394d92fb291fc7902b639a3e92ba9144e403816265d79b739193572cc15dcaec14a09cf59ba9b9f4f8ed00212e935f7c16a6294ec67ec14c5193
SSDEEP 3072:up/r/XWcqLhrksdsUrPYdBqaTl723DSVhdu1SAA8YcG9lKVf1svV+NhcmEx:uNzGcU9LPGQaTASlu1STVJGMV+4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey

Malware Config

Extracted

Family

amadey

Version

3.66

C2

193.42.33.28/0bjdn2Z/index.php

Signatures

Amadey family
amadey

File Explorer

tmp

.exe 227KB

tmp

IMPHASH dd0e4efabc62274a7cfb37b4b7a2951d
SHA256 3f3dadd2a5177fb918eabacc6a433d46f1975dd9c18cc0a7b63e09669625b800
MD5 17a8f85f937d8106c020a366d7c6ccb4
SHA1 43ef57b2adf9115c51041b5baba5a1565501b1a1
SHA512 ca6e62269cb5394d92fb291fc7902b639a3e92ba9144e403816265d79b739193572cc15dcaec14a09cf59ba9b9f4f8ed00212e935f7c16a6294ec67ec14c5193
SSDEEP 3072:up/r/XWcqLhrksdsUrPYdBqaTl723DSVhdu1SAA8YcG9lKVf1svV+NhcmEx:uNzGcU9LPGQaTASlu1STVJGMV+4
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

88757

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetFileAttributesA CreateFileA CloseHandle GetSystemInfo CreateThread HeapAlloc GetThreadContext GetProcAddress VirtualAllocEx CopyFileA RemoveDirectoryA ReadProcessMemory GetProcessHeap CreateProcessA CreateDirectoryA SetThreadContext WriteConsoleW ReadConsoleW SetEndOfFile HeapReAlloc HeapSize GetTempPathA Sleep SetCurrentDirectoryA GetModuleHandleA GetComputerNameExW ResumeThread GetVersionExW CreateMutexW VirtualAlloc WriteFile VirtualFree HeapFree WriteProcessMemory GetModuleFileNameA LocalFree ReadFile SetFilePointerEx GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW MultiByteToWideChar CompareStringW LCMapStringW DecodePointer

advapi32

RegCloseKey RegQueryValueExA GetUserNameA RegSetValueExA RegOpenKeyExA ConvertSidToStringSidW GetUserNameW LookupAccountNameW

shell32

ShellExecuteA ord680 SHGetFolderPathA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenW InternetOpenUrlA

Sharing