amadey | ProxyLeecherbyAlphacrack_[.]exe

General

Target
ProxyLeecherbyAlphacrack_.exe
Size 16.1MB
Sample250529-py47wssjs2
SHA256 e677a9da84b5b1a612abb286c046b17dd32f1dda2892a16a82e6ef4605156a12
MD5 a8983bbf9737642d5ec6470ed6c9067d
SHA1 22fd3f8cbfae785650670ecf5b7de8f973c9c1b3
SHA512 ba62affff6f150e4e76739ac39c64cb135d0a044a2c0c84a18629ae5ac85845f86189d34cf3339a9952a3fd4892b449844165cd5bec7c29c141331b228ba5639
SSDEEP 393216:MHDiN8DWiXLYEdYHi9WJdoyMxtDDAx5w5EpELVHWI3DA:Q1WiX0gYHY+doy2AHpEtWI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pyinstaller amadey

Malware Config

Signatures

Amadey family
amadey

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ProxyLeecherbyAlphacrack_.exe

File Explorer

ProxyLeecherbyAlphacrack_.exe

.exe 16.1MB
zx.pyc

2KB

ProxyLeecherbyAlphacrack_.exe

IMPHASH 223f8057932cb61043b0989210626737
SHA256 e677a9da84b5b1a612abb286c046b17dd32f1dda2892a16a82e6ef4605156a12
MD5 a8983bbf9737642d5ec6470ed6c9067d
SHA1 22fd3f8cbfae785650670ecf5b7de8f973c9c1b3
SHA512 ba62affff6f150e4e76739ac39c64cb135d0a044a2c0c84a18629ae5ac85845f86189d34cf3339a9952a3fd4892b449844165cd5bec7c29c141331b228ba5639
SSDEEP 393216:MHDiN8DWiXLYEdYHi9WJdoyMxtDDAx5w5EpELVHWI3DA:Q1WiX0gYHY+doy2AHpEtWI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

24364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteW

kernel32

TlsSetValue WriteConsoleW WriteFile CreateFileW LoadLibraryA CloseHandle GetCurrentDirectoryW GetProcAddress FreeLibrary EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess HeapSize RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue RtlUnwind TlsFree LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap

Resubmissions

Sharing