amadey | f172c0d1e3d3f04ded1320a6c78d0040[.]exe

General

Target
f172c0d1e3d3f04ded1320a6c78d0040.exe
Size 314KB
Sample230812-l5mpmsbc25
SHA256 39efbda4e43054f1240d3d4888cb13f83be9331bbfe6c351078ec02cb65ec14e
MD5 f172c0d1e3d3f04ded1320a6c78d0040
SHA1 96771aaadcd947862e7869f146620060fe0f22c3
SHA512 2b10774f4c18a397d97e7ec766040829bfec6893bbe459e47edf05dc40f0f0648adc2ef4d4f7bde3700f74a9b073287d15bf5af56c433870c503fb5e192b65d4
SSDEEP 6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey

Malware Config

Extracted

Family

amadey

Version

S-%lu-

C2

77.91.68.18/nice/index.php
3.87/nice/index.php

Signatures

Amadey family
amadey

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f172c0d1e3d3f04ded1320a6c78d0040.exe

File Explorer

f172c0d1e3d3f04ded1320a6c78d0040.exe

.exe 314KB

f172c0d1e3d3f04ded1320a6c78d0040.exe

IMPHASH 44e769941d2c6ad88bf42ac4adb36135
SHA256 39efbda4e43054f1240d3d4888cb13f83be9331bbfe6c351078ec02cb65ec14e
MD5 f172c0d1e3d3f04ded1320a6c78d0040
SHA1 96771aaadcd947862e7869f146620060fe0f22c3
SHA512 2b10774f4c18a397d97e7ec766040829bfec6893bbe459e47edf05dc40f0f0648adc2ef4d4f7bde3700f74a9b073287d15bf5af56c433870c503fb5e192b65d4
SSDEEP 6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102532

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetSystemInfo CreateThread GetThreadContext GetProcAddress VirtualAllocEx RemoveDirectoryA CreateFileA CreateProcessA CreateDirectoryA SetThreadContext SetEndOfFile HeapSize GetProcessHeap SetEnvironmentVariableW GetFileAttributesA GetLastError GetTempPathA Sleep GetModuleHandleA SetCurrentDirectoryA ResumeThread GetComputerNameExW GetVersionExW CreateMutexA VirtualAlloc WriteFile VirtualFree WriteProcessMemory GetModuleFileNameA ReadProcessMemory ReadFile FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc ReadConsoleW SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapAlloc HeapFree GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer MultiByteToWideChar CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RaiseException RtlUnwind FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW GetFileSizeEx WriteConsoleW

advapi32

RegCloseKey RegQueryValueExA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameA LookupAccountNameA RegSetValueExA RegOpenKeyExA GetSidIdentifierAuthority

shell32

ShellExecuteA ord680 SHGetFolderPathA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenW InternetOpenUrlA

Sharing