amadey | SecuriteInfo[.]com[.]Variant[.]Doina[.]48774[.]3540[.]14436[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe
Size 244KB
Sample230320-nlj6hsdc33
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
SSDEEP 6144:y324aAQBPEFA7OTnYZf/NPPoNqgu1ynfDwnE:yQcF/uf/9ozu1yG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey

Malware Config

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Signatures

Amadey family
amadey

File Explorer

SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe

.exe 244KB

SecuriteInfo.com.Variant.Doina.48774.3540.14436.exe

IMPHASH ff81011ab3449dee85df51db7b508091
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
SSDEEP 6144:y324aAQBPEFA7OTnYZf/NPPoNqgu1ynfDwnE:yQcF/uf/9ozu1yG
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

102949

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError GetFileAttributesA CreateFileA CloseHandle GetSystemInfo CreateThread HeapAlloc GetThreadContext GetProcAddress VirtualAllocEx CopyFileA RemoveDirectoryA ReadProcessMemory GetProcessHeap CreateProcessA CreateDirectoryA SetThreadContext WriteConsoleW ReadConsoleW SetEndOfFile HeapReAlloc HeapSize GetTempPathA Sleep SetCurrentDirectoryA GetModuleHandleA GetComputerNameExW ResumeThread GetVersionExW CreateMutexW VirtualAlloc WriteFile VirtualFree HeapFree WriteProcessMemory GetModuleFileNameA LocalFree ReadFile SetFilePointerEx GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW MultiByteToWideChar CompareStringW LCMapStringW DecodePointer

user32

GetSystemMetrics ReleaseDC GetDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

RegCloseKey RegGetValueA RegQueryValueExA GetUserNameA RegSetValueExA RegOpenKeyExA ConvertSidToStringSidW GetUserNameW LookupAccountNameW

shell32

ShellExecuteA ord680 SHGetFolderPathA

wininet

HttpOpenRequestA InternetWriteFile InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpAddRequestHeadersA HttpSendRequestExW HttpEndRequestA InternetOpenW InternetOpenUrlA

gdiplus

GdipSaveImageToFile GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdiplusShutdown GdiplusStartup