amadey | b87a8c88ccee7bcdd33e3a217756b07f[.]exe

General

Target
b87a8c88ccee7bcdd33e3a217756b07f.exe
Size 220KB
Sample230907-gva6msfa27
SHA256 d4463b448b1d6850d136f4ddf5e7a04db78fa3a64b57dfdb04e1bdd1f27faa4d
MD5 b87a8c88ccee7bcdd33e3a217756b07f
SHA1 8c0ac5d5ca8616ef1bb78d7a10f25673cc8bfe23
SHA512 34492489646f7cf2cff799198ce52310f21f3b3a3e0d4442eb8041451570f15cf41b29357eee2ab43d5a79c4c9a552e43874e1261ee5c4a72c3f3946f0e98537
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey

Malware Config

Extracted

Family

amadey

Version

3.89

C2

77.91.68.52/mac/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey family
amadey

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b87a8c88ccee7bcdd33e3a217756b07f.exe

File Explorer

b87a8c88ccee7bcdd33e3a217756b07f.exe

.exe 220KB

b87a8c88ccee7bcdd33e3a217756b07f.exe

IMPHASH 3865972614d44e518713c9a6183fed14
SHA256 d4463b448b1d6850d136f4ddf5e7a04db78fa3a64b57dfdb04e1bdd1f27faa4d
MD5 b87a8c88ccee7bcdd33e3a217756b07f
SHA1 8c0ac5d5ca8616ef1bb78d7a10f25673cc8bfe23
SHA512 34492489646f7cf2cff799198ce52310f21f3b3a3e0d4442eb8041451570f15cf41b29357eee2ab43d5a79c4c9a552e43874e1261ee5c4a72c3f3946f0e98537
SSDEEP 6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83249

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA CloseHandle GetSystemInfo CreateThread GetThreadContext GetProcAddress VirtualAllocEx RemoveDirectoryA GetFileAttributesA CreateProcessA CreateDirectoryA SetThreadContext WriteConsoleW ReadConsoleW SetEndOfFile HeapReAlloc HeapSize GetLastError CopyFileA GetTempPathA Sleep GetModuleHandleA SetCurrentDirectoryA ResumeThread GetComputerNameExW GetVersionExW CreateMutexA VirtualAlloc WriteFile VirtualFree WriteProcessMemory GetModuleFileNameA ReadProcessMemory ReadFile SetFilePointerEx GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RaiseException SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc MultiByteToWideChar CompareStringW LCMapStringW DecodePointer

advapi32

RegCloseKey RegQueryValueExA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameA LookupAccountNameA RegSetValueExA RegOpenKeyExA GetSidIdentifierAuthority

shell32

ShellExecuteA ord680 SHGetFolderPathA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenW InternetOpenUrlA

Sharing