amadey | 8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5[.]bin

General

Target
8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5.bin
Size 321KB
Sample261107-vs55wsev5j
SHA256 8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5
MD5 8c99d1a8660a91bc17515ce50ee6b236
SHA1 845a2684038c5f00719132f22986a6e87bc7718c
SHA512 81ab1c83fd3687e1248de9e5a5e6d133425d7f5d2e145f9d798b98bb4c64bbb6300c199dd1063cf7459565266caa1c45e7b35656a7042f2879a43d5b6ee46557
SSDEEP 6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq
TLSH
T1966439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

59b440 trojan amadey

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

C2

http://77.91.68.18

Attributes

install_dir
b40d11255d
install_file
saves.exe
strings_key
fa622dfc42544927a6471829ee1fa9fe
url_paths
/nice/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
sample	family_amadey_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5.bin

File Explorer

8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5.bin

.exe 321KB

8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5.bin

IMPHASH 44e769941d2c6ad88bf42ac4adb36135
SHA256 8b5d014d5094d5b7a616c0ba88127b9dff8f3ed67bdd378e2b7a214c867f4ea5
MD5 8c99d1a8660a91bc17515ce50ee6b236
SHA1 845a2684038c5f00719132f22986a6e87bc7718c
SHA512 81ab1c83fd3687e1248de9e5a5e6d133425d7f5d2e145f9d798b98bb4c64bbb6300c199dd1063cf7459565266caa1c45e7b35656a7042f2879a43d5b6ee46557
SSDEEP 6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq
TLSH
T1966439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Amadey x86-bit Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

102532

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Mktmp\Amadey\Release\Amadey.pdb

kernel32

CloseHandle GetSystemInfo CreateThread GetThreadContext GetProcAddress VirtualAllocEx RemoveDirectoryA CreateFileA CreateProcessA CreateDirectoryA SetThreadContext SetEndOfFile HeapSize GetProcessHeap SetEnvironmentVariableW GetFileAttributesA GetLastError GetTempPathA Sleep GetModuleHandleA SetCurrentDirectoryA ResumeThread GetComputerNameExW GetVersionExW CreateMutexA VirtualAlloc WriteFile VirtualFree WriteProcessMemory GetModuleFileNameA ReadProcessMemory ReadFile FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc ReadConsoleW SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapAlloc HeapFree GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer MultiByteToWideChar CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RaiseException RtlUnwind FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW GetFileSizeEx WriteConsoleW

advapi32

RegCloseKey RegQueryValueExA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameA LookupAccountNameA RegSetValueExA RegOpenKeyExA GetSidIdentifierAuthority

shell32

ShellExecuteA ord680 SHGetFolderPathA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenW InternetOpenUrlA

Sharing