amadey | 689ff816fc3db38894e81abbdf63c02b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
689ff816fc3db38894e81abbdf63c02b.exe
Size 549KB
Sample241015-tmcqqatdqa
SHA256 f2ebbd96f7cf19aa8cc8b1273d1f80169de93ac4dde951ff4547177a11010945
MD5 689ff816fc3db38894e81abbdf63c02b
SHA1 aceb8ce81d4724d77a1b3031015f6e60d1139352
SHA512 b7eefa534ab5b409718d8b2287983417299f78bfed6696bba1037d3c816c3cadd172e5d59b0ff6e4ee8abf340cbc396c1695a075e747030fa7f6d2bfcfb8ef4c
SSDEEP 12288:MzW5JeQqp6xEWEoiH5KlCrX4FZg40rvM1BCpkLDapAGEhoCXOfNw9lu+eqQoEzwz:MzWCKlCroFWHr6BCCXau7X3pP7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

61b84f amadey

Malware Config

Extracted

Family

amadey

Version

5.03

Botnet

61b84f

http://78.153.139.168

Attributes

install_dir
76c5995d57
install_file
Gxtuum.exe
strings_key
9de0451ffa8c2fdfc09ef4161fee0a87
url_paths
/gfj38cHcw/index.php

rc4.plain

Signatures

Amadey family
amadey

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
689ff816fc3db38894e81abbdf63c02b.exe

File Explorer

689ff816fc3db38894e81abbdf63c02b.exe

.exe 549KB

689ff816fc3db38894e81abbdf63c02b.exe

IMPHASH 91d1583dab6f50e9cc35b0dbf587fb1f
SHA256 f2ebbd96f7cf19aa8cc8b1273d1f80169de93ac4dde951ff4547177a11010945
MD5 689ff816fc3db38894e81abbdf63c02b
SHA1 aceb8ce81d4724d77a1b3031015f6e60d1139352
SHA512 b7eefa534ab5b409718d8b2287983417299f78bfed6696bba1037d3c816c3cadd172e5d59b0ff6e4ee8abf340cbc396c1695a075e747030fa7f6d2bfcfb8ef4c
SSDEEP 12288:MzW5JeQqp6xEWEoiH5KlCrX4FZg40rvM1BCpkLDapAGEhoCXOfNw9lu+eqQoEzwz:MzWCKlCroFWHr6BCCXau7X3pP7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

175164

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesA Process32NextW CreateFileA Process32FirstW CloseHandle GetSystemInfo CreateThread GetLocalTime GetThreadContext GetProcAddress GetLastError RemoveDirectoryA ReadProcessMemory CreateProcessA CreateDirectoryA SetThreadContext SetEndOfFile HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW Wow64RevertWow64FsRedirection GetTempPathA Sleep CreateToolhelp32Snapshot OpenProcess SetCurrentDirectoryA GetModuleHandleA ResumeThread GetComputerNameExW GetVersionExW WaitForSingleObject CreateMutexA FindClose PeekNamedPipe CreatePipe FindNextFileA VirtualAlloc Wow64DisableWow64FsRedirection WriteFile VirtualFree FindFirstFileA SetHandleInformation WriteProcessMemory GetModuleFileNameA VirtualAllocEx ReadFile GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation HeapReAlloc ReadConsoleW SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapAlloc HeapFree GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle GetDriveTypeW CreateFileW ExitProcess RtlUnwind LoadLibraryW UnregisterWaitEx QueryDepthSList InterlockedFlushSList RaiseException GetCurrentThreadId IsProcessorFeaturePresent QueueUserWorkItem GetModuleHandleExW FormatMessageW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW WaitForSingleObjectEx QueryPerformanceCounter EncodePointer DecodePointer MultiByteToWideChar CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW VirtualProtect DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList WriteConsoleW

user32

GetSystemMetrics ReleaseDC GetDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

RevertToSelf RegCloseKey RegQueryInfoKeyW RegGetValueA RegQueryValueExA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameA CreateProcessWithTokenW LookupAccountNameA ImpersonateLoggedOnUser RegSetValueExA OpenProcessToken RegOpenKeyExA RegEnumValueA DuplicateTokenEx GetSidIdentifierAuthority

shell32

SHGetFolderPathA ShellExecuteA SHFileOperationA

ole32

CoUninitialize CoCreateInstance CoInitialize

wininet

HttpOpenRequestA InternetWriteFile InternetOpenUrlA InternetOpenW HttpEndRequestW HttpAddRequestHeadersA HttpSendRequestExA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile

gdiplus

GdiplusStartup GdipSaveImageToFile GdipGetImageEncodersSize GdiplusShutdown GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage

ws2_32

closesocket inet_pton getaddrinfo WSAStartup send socket connect recv htons freeaddrinfo