amadey | adc6f513f7fa107969e5d836a74f38b4[.]exe

General

Target
adc6f513f7fa107969e5d836a74f38b4.exe
Size 220KB
Sample230907-ds2n2aec2t
SHA256 8aa36714a28693b22e5ca090e3c647c8d71e1214f6a497407f92d9923bee8d29
MD5 adc6f513f7fa107969e5d836a74f38b4
SHA1 140c369c273c23274c4f2420e22185574b7c461e
SHA512 f99aa1653b91a5f53f86a3c5bc1769cf5daa778c9cb3ed8f5c60f1327445c2df648be18b85ddb59b5c31d5f2fb4f424af3e17f586c83306ca7e886f715413b23
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey

Malware Config

Extracted

Family

amadey

Version

3.89

C2

77.91.68.52/mac/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey family
amadey

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adc6f513f7fa107969e5d836a74f38b4.exe

File Explorer

adc6f513f7fa107969e5d836a74f38b4.exe

.exe 220KB

adc6f513f7fa107969e5d836a74f38b4.exe

IMPHASH 3865972614d44e518713c9a6183fed14
SHA256 8aa36714a28693b22e5ca090e3c647c8d71e1214f6a497407f92d9923bee8d29
MD5 adc6f513f7fa107969e5d836a74f38b4
SHA1 140c369c273c23274c4f2420e22185574b7c461e
SHA512 f99aa1653b91a5f53f86a3c5bc1769cf5daa778c9cb3ed8f5c60f1327445c2df648be18b85ddb59b5c31d5f2fb4f424af3e17f586c83306ca7e886f715413b23
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83249

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA CloseHandle GetSystemInfo CreateThread GetThreadContext GetProcAddress VirtualAllocEx RemoveDirectoryA GetFileAttributesA CreateProcessA CreateDirectoryA SetThreadContext WriteConsoleW ReadConsoleW SetEndOfFile HeapReAlloc HeapSize GetLastError CopyFileA GetTempPathA Sleep GetModuleHandleA SetCurrentDirectoryA ResumeThread GetComputerNameExW GetVersionExW CreateMutexA VirtualAlloc WriteFile VirtualFree WriteProcessMemory GetModuleFileNameA ReadProcessMemory ReadFile SetFilePointerEx GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RaiseException SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc MultiByteToWideChar CompareStringW LCMapStringW DecodePointer

advapi32

RegCloseKey RegQueryValueExA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameA LookupAccountNameA RegSetValueExA RegOpenKeyExA GetSidIdentifierAuthority

shell32

ShellExecuteA ord680 SHGetFolderPathA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenW InternetOpenUrlA

Sharing