General

  • Target

    130a5d328dc219fa4489c01b86313be3e4bba654d00e2b4b5c7e3c66a43f526d

  • Size

    14.4MB

  • MD5

    66c401fc2787ec69e00fb7af8ba59d20

  • SHA1

    228d8506fae7502f3ed0555eef17d05af44a8c2c

  • SHA256

    130a5d328dc219fa4489c01b86313be3e4bba654d00e2b4b5c7e3c66a43f526d

  • SHA512

    d2541c665014f4abaf00e0a24c666dc71916c98921d80b477640332e839e378190b944b188bcbf10b17e6babe517e9f175fbb7d68e0c5e83f69ad11cc0869eae

  • SSDEEP

    393216:t5WrDD/48Pqm0Os1EsV++kW0aY/hBa+piN:Kv/48Pqm3s8e0/vLiN

Score
10/10

Malware Config

Signatures

  • Amadey family
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

Files

  • 130a5d328dc219fa4489c01b86313be3e4bba654d00e2b4b5c7e3c66a43f526d
    .zip
  • AVCap.dll
    .dll windows:4 windows x86 arch:x86

    57f2399a70c656eea8932943dee4a08d


    Headers

    Imports

    Exports

    Sections

  • Data/Asset/Tips.txt
  • Data/Asset/WinMsg.txt
  • Data/Asset/info.png
    .png
  • Data/Asset/new.txt
  • Data/Asset/notify.wav
  • Data/Asset/unins.ico
  • Data/Hotkeys.init
    .xml
  • Data/Lang/English.lng
  • Data/Lang/.lng
  • Data/Sound/Bell/Bell.wav
  • Data/Sound/Bell/BigBen.wav
  • Data/Sound/Bell/Chimes.wav
  • Data/Sound/Bell/Clock.wav
  • Data/Sound/Bell/Cuckoo.wav
  • Data/Sound/Bell/Doorbl.wav
  • Data/Sound/Bell/Reville.wav
  • Data/Sound/Bell/Rooster.wav
  • Data/Sound/QQ.wav
  • Data/Sound/Stars/0/T0.wav
  • Data/Sound/Stars/0/T1.wav
  • Data/Sound/Stars/0/T10.wav
  • Data/Sound/Stars/0/T11.wav
  • Data/Sound/Stars/0/T12.wav
  • Data/Sound/Stars/0/T13.wav
  • Data/Sound/Stars/0/T14.wav
  • Data/Sound/Stars/0/T15.wav
  • Data/Sound/Stars/0/T16.wav
  • Data/Sound/Stars/0/T17.wav
  • Data/Sound/Stars/0/T18.wav
  • Data/Sound/Stars/0/T19.wav
  • Data/Sound/Stars/0/T2.wav
  • Data/Sound/Stars/0/T20.wav
  • Data/Sound/Stars/0/T21.wav
  • Data/Sound/Stars/0/T22.wav
  • Data/Sound/Stars/0/T23.wav
  • Data/Sound/Stars/0/T3.wav
  • Data/Sound/Stars/0/T4.wav
  • Data/Sound/Stars/0/T5.wav
  • Data/Sound/Stars/0/T6.wav
  • Data/Sound/Stars/0/T7.wav
  • Data/Sound/Stars/0/T8.wav
  • Data/Sound/Stars/0/T9.wav
  • Data/Sound/Stars/1/T0.wav
  • Data/Sound/Stars/1/T1.wav
  • Data/Sound/Stars/1/T10.wav
  • Data/Sound/Stars/1/T11.wav
  • Data/Sound/Stars/1/T12.wav
  • Data/Sound/Stars/1/T13.wav
  • Data/Sound/Stars/1/T14.wav
  • Data/Sound/Stars/1/T15.wav
  • Data/Sound/Stars/1/T16.wav
  • Data/Sound/Stars/1/T17.wav
  • Data/Sound/Stars/1/T18.wav
  • Data/Sound/Stars/1/T19.wav
  • Data/Sound/Stars/1/T2.wav
  • Data/Sound/Stars/1/T20.wav
  • Data/Sound/Stars/1/T21.wav
  • Data/Sound/Stars/1/T22.wav
  • Data/Sound/Stars/1/T23.wav
  • Data/Sound/Stars/1/T3.wav
  • Data/Sound/Stars/1/T4.wav
  • Data/Sound/Stars/1/T5.wav
  • Data/Sound/Stars/1/T6.wav
  • Data/Sound/Stars/1/T7.wav
  • Data/Sound/Stars/1/T8.wav
  • Data/Sound/Stars/1/T9.wav
  • Data/Sound/Woman/Now.wav
  • Data/Sound/Woman/T0.wav
  • Data/Sound/Woman/T1.wav
  • Data/Sound/Woman/T10.wav
  • Data/Sound/Woman/T2.wav
  • Data/Sound/Woman/T3.wav
  • Data/Sound/Woman/T4.wav
  • Data/Sound/Woman/T5.wav
  • Data/Sound/Woman/T6.wav
  • Data/Sound/Woman/T7.wav
  • Data/Sound/Woman/T8.wav
  • Data/Sound/Woman/T9.wav
  • Data/Sound/Woman/TH.wav
  • Data/Sound/Woman/TL.wav
  • Data/Sound/Woman/TM.wav
  • Data/Sound/.wav
  • Data/Sound/.mp3
  • Data/Sound/.wav
  • Data/Sound/.mp3
  • Data/Sound/.mp3
  • Data/Tasks.init
    .xml
  • EverAuto.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    207a1ae03022ef0c0445434e37a382f1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • HotKey.dll
    .dll windows:6 windows x86 arch:x86

    108f71ed045058dd1f8dcdcb063fdf65


    Headers

    Imports

    Exports

    Sections

  • Http.dll
    .dll windows:6 windows x86 arch:x86

    4770ab3e568f45b725b20720f504ffb0


    Headers

    Imports

    Exports

    Sections

  • License.txt
  • Mail.dll
    .dll windows:6 windows x86 arch:x86

    0531da7f1f5d5b56b6992edcf3df6bbb


    Headers

    Imports

    Exports

    Sections

  • ModernZip.dll
    .dll windows:6 windows x86 arch:x86

    c29bd6843aa02387588908093ae0f4ac


    Headers

    Imports

    Exports

    Sections

  • Ping.dll
    .dll windows:6 windows x86 arch:x86

    769579ed86dde3d91820cef630f21510


    Headers

    Imports

    Exports

    Sections

  • Res.dll
    .zip
  • SFML license.txt
  • SndPlay.dll
    .dll windows:6 windows x86 arch:x86

    c93cea503e85108462f41f25a9ea0d9d


    Headers

    Imports

    Exports

    Sections

  • TimeSync.dll
    .dll windows:6 windows x86 arch:x86

    f9a0bf38a80a9476689ceb4ef1d014e7


    Headers

    Imports

    Exports

    Sections

  • UI.dll
    .dll windows:6 windows x86 arch:x86

    b5658c71944937b5711489eb6ca49263


    Headers

    Imports

    Exports

    Sections

  • Utility.dll
    .dll windows:6 windows x86 arch:x86

    775914b5bb352919492829a526321bdc


    Headers

    Imports

    Exports

    Sections

  • Volume.dll
    .dll windows:6 windows x86 arch:x86

    e720f0a0fe20dd899d21d1e99940eafd


    Headers

    Imports

    Exports

    Sections

  • Xml.dll
    .dll windows:6 windows x86 arch:x86

    f0049db414ac931049c986fafbdd0e93


    Headers

    Imports

    Exports

    Sections

  • ZipWrapper.dll
    .dll windows:6 windows x86 arch:x86

    0c7d02c09068f44ab5f95d86b5c98ff6


    Headers

    Imports

    Exports

    Sections

  • api-ms-win-dll/API-MS-Win-core-xstate-l2-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-console-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-console-l1-2-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-datetime-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-debug-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-errorhandling-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-file-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-file-l1-2-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-file-l2-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-handle-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-heap-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-interlocked-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-libraryloader-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-localization-l1-2-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-memory-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-namedpipe-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-processenvironment-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-processthreads-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-processthreads-l1-1-1.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-profile-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-string-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-synch-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-synch-l1-2-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-timezone-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-core-util-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-conio-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-convert-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-environment-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-heap-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-locale-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-math-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-private-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-process-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-runtime-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-stdio-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-string-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-time-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • api-ms-win-dll/api-ms-win-crt-utility-l1-1-0.dll
    .dll windows:10 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • asl LICENSE.txt
  • asl.dll
    .dll windows:6 windows x86 arch:x86

    9fd4642b2d2c6dcdff8ffec045a2163f


    Headers

    Imports

    Exports

    Sections

  • bass.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • directui license.txt
  • httplib LICENSE.txt
  • libcrypto-3.dll
    .dll windows:6 windows x86 arch:x86

    0d44d8959be34a5b5d94926a056953a1


    Headers

    Imports

    Exports

    Sections

  • libssl-3.dll
    .dll windows:6 windows x86 arch:x86

    c2647ba6dc07c5fdc654fb0cfeddb59c


    Headers

    Imports

    Exports

    Sections

  • msvcp140.dll
    .dll windows:6 windows x86 arch:x86

    7d4a94e128dda6c7a10e11a890bebd9e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • openal32.dll
    .dll windows:5 windows x86 arch:x86

    64ebbc29b620d87aff4dae9fd800a16d


    Headers

    Imports

    Exports

    Sections

  • sfml-audio-2.dll
    .dll windows:6 windows x86 arch:x86

    abc2679b54e8626eaeeca38b75ec2216


    Headers

    Imports

    Exports

    Sections

  • sfml-system-2.dll
    .dll windows:6 windows x86 arch:x86

    7d95ceabf24f9847c303e282acb2ebb0


    Headers

    Imports

    Exports

    Sections

  • ucrtbase.dll
    .dll windows:10 windows x86 arch:x86

    71f1d8a10f840ffee6964317e974d463


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    b1497ec17e3cfac16846155a7a629324


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • web.dll
    .zip
  • zTasker.exe
    .exe windows:6 windows x86 arch:x86

    01c2965fedc6c68d1cc882c5d1d6a2c1


    Headers

    Imports

    Sections

  • zTaskerUp.exe
    .exe windows:6 windows x86 arch:x86

    1038584db0272e69f750c961426d45db


    Headers

    Imports

    Sections