amadey | jaffacakes118_4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7.bin
Size 1.0MB
Sample260912-nc5qvsae72
SHA256 4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7
MD5 2b11dbc8213efc194e4b5f2b5b041cdd
SHA1 566a74820b40512eccd967ea13fbfe22c0e40b01
SHA512 2e41a1f82ef5c500a3b2bb068933c27b153a5791d38ac07e5e7b9cc23a96dde243c4941862a192654968449444932e80f5602f020aa5c76df37df43118a2e944
SSDEEP 24576:eNFxrUgNQW8vbLmjXGWDVcwBlTdMDazjlysf7djzHZwiGs:eNFxogGPmzcGVjzBGs
TLSH
T146358E05FA53D0B1D8D420B011B6BBF2597C6639A72445DBAB801FB69E201F33E37B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

c3450b trojan amadey

Malware Config

Extracted

Family

amadey

Version

5.04

Botnet

c3450b

http://185.208.158.96

Attributes

strings_key
b032f23912454b9cac163491e8668481
url_paths
/mzmtrpwoe113eelxn/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
sample	family_amadey_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7.bin

File Explorer

jaffacakes118_4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7.bin

.dll 1.0MB

jaffacakes118_4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7.bin

IMPHASH 7e8b0331b68a47254f7000efd39b30a8
SHA256 4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7
MD5 2b11dbc8213efc194e4b5f2b5b041cdd
SHA1 566a74820b40512eccd967ea13fbfe22c0e40b01
SHA512 2e41a1f82ef5c500a3b2bb068933c27b153a5791d38ac07e5e7b9cc23a96dde243c4941862a192654968449444932e80f5602f020aa5c76df37df43118a2e944
SSDEEP 24576:eNFxrUgNQW8vbLmjXGWDVcwBlTdMDazjlysf7djzHZwiGs:eNFxogGPmzcGVjzBGs
TLSH
T146358E05FA53D0B1D8D420B011B6BBF2597C6639A72445DBAB801FB69E201F33E37B29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Amadey x86-bit Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

776558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

crypt32

CryptUnprotectData

kernel32

GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SetHandleInformation FindFirstFileA Wow64DisableWow64FsRedirection K32GetModuleFileNameExW FindNextFileA CreatePipe PeekNamedPipe lstrlenA FindClose GetCurrentDirectoryA lstrcatA OpenProcess SetCurrentDirectoryA CreateToolhelp32Snapshot ProcessIdToSessionId CopyFileA Wow64RevertWow64FsRedirection Process32NextW Process32FirstW CreateThread CreateProcessA CreateDirectoryA ReadConsoleW InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI SetFilePointer SetFilePointerEx GetConsoleMode GetConsoleOutputCP SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetStdHandle GetCurrentDirectoryW GetStdHandle GetTimeZoneInformation UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW InitializeSListHead LCMapStringEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW RaiseException InterlockedFlushSList RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileInformationByHandle GetFileType SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleFileNameW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteConsoleW

advapi32

GetSidSubAuthority RegEnumValueW RegEnumKeyA RegCloseKey RegQueryInfoKeyW RegOpenKeyA RegQueryValueExA GetSidSubAuthorityCount RegOpenKeyExA GetUserNameA RegEnumKeyExW LookupAccountNameA GetSidIdentifierAuthority

shell32

SHFileOperationA SHGetFolderPathA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpAddRequestHeadersA HttpSendRequestExW HttpEndRequestA InternetOpenW InternetWriteFile

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt