Behavioral task
behavioral1
Sample
1496-371-0x0000000000400000-0x0000000002BC5000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1496-371-0x0000000000400000-0x0000000002BC5000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1496-371-0x0000000000400000-0x0000000002BC5000-memory.dmp
-
Size
39.8MB
-
MD5
b137a1df444935adbc74ee599da68c92
-
SHA1
92629fa9376020d3e1a19058b03716719d22fe91
-
SHA256
63945d0449a3c9cc17d88ca3338a06a7ad682be9a68c62bfe7668056c0e8ac13
-
SHA512
d32ccf43847f3a8f72a4b8e856a2ee3463015ceb0ec5d7d372af66aa90811a13d04c66930acf0d88dd7b72fafa24bf54cab0767ddfdfd055cfd2bec6659bbd7c
-
SSDEEP
6144:adcDoxvj/FLrQCZl74VzLaBBkuFye6x3x07rUrN7z:6zrZlMaBBkuFyeOh0Y/
Malware Config
Extracted
amadey
3.67
85.31.45.199/dF30Hn4m/index.php
Signatures
-
Amadey family
Files
-
1496-371-0x0000000000400000-0x0000000002BC5000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 189KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ