amadey | c33d706b61ac277c2d46b62a801f6802[.]exe

General

Target
c33d706b61ac277c2d46b62a801f6802.exe
Size 219KB
Sample230906-qeyfnsfe99
SHA256 20d7eb971d3ae8899159d50b3c0de0a0dd134b41bf82adfae5b97352eaed1ecd
MD5 c33d706b61ac277c2d46b62a801f6802
SHA1 07cc370058e97f8e14fcdb96127b4598a4da8b0f
SHA512 19899bbd4df7540ce2c101f2071e428bc375da644554a7f1b4361c1b1d503772974391b271d126ee24ed0d11880a19a5b665e2d95db118aa623235f6b3e4ed3f
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey

Malware Config

Extracted

Family

amadey

Version

3.89

C2

77.91.68.52/mac/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey family
amadey

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c33d706b61ac277c2d46b62a801f6802.exe

File Explorer

c33d706b61ac277c2d46b62a801f6802.exe

.exe 219KB

c33d706b61ac277c2d46b62a801f6802.exe

IMPHASH 3865972614d44e518713c9a6183fed14
SHA256 20d7eb971d3ae8899159d50b3c0de0a0dd134b41bf82adfae5b97352eaed1ecd
MD5 c33d706b61ac277c2d46b62a801f6802
SHA1 07cc370058e97f8e14fcdb96127b4598a4da8b0f
SHA512 19899bbd4df7540ce2c101f2071e428bc375da644554a7f1b4361c1b1d503772974391b271d126ee24ed0d11880a19a5b665e2d95db118aa623235f6b3e4ed3f
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83249

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA CloseHandle GetSystemInfo CreateThread GetThreadContext GetProcAddress VirtualAllocEx RemoveDirectoryA GetFileAttributesA CreateProcessA CreateDirectoryA SetThreadContext WriteConsoleW ReadConsoleW SetEndOfFile HeapReAlloc HeapSize GetLastError CopyFileA GetTempPathA Sleep GetModuleHandleA SetCurrentDirectoryA ResumeThread GetComputerNameExW GetVersionExW CreateMutexA VirtualAlloc WriteFile VirtualFree WriteProcessMemory GetModuleFileNameA ReadProcessMemory ReadFile SetFilePointerEx GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RaiseException SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc MultiByteToWideChar CompareStringW LCMapStringW DecodePointer

advapi32

RegCloseKey RegQueryValueExA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameA LookupAccountNameA RegSetValueExA RegOpenKeyExA GetSidIdentifierAuthority

shell32

ShellExecuteA ord680 SHGetFolderPathA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenW InternetOpenUrlA

Sharing