Summary | ZeroBOX

scr.dll

Amadey JPEG Format PE32 PE File DLL
Category Machine Started Completed
FILE s1_win7_x6401 May 6, 2021, 1:47 p.m. May 6, 2021, 1:48 p.m.
Size 222.0KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 a48dc2da2655fd049e37e36fcda28fba
SHA256 76f6c712403a2f6213390ab2a72a82c98c9c48e1b1bde182aa5932bd02a06d43
CRC32 B511E709
ssdeep 6144:SJ+WK/pvT7arfwKFzDTsv5oaTh45CjBscX9TlHN:JJpb7Y7vf5i5X9TFN
Yara
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win_Amadey_Zero - Amadey bot

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
176.111.174.114 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 176.111.174.114:80 -> 192.168.56.101:49199 2400021 ET DROP Spamhaus DROP Listed Traffic Inbound group 22 Misc Attack

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76891000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d30000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73771000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b94000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c71000
process_handle: 0xffffffff
1 0 0
host 176.111.174.114
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Doina.2666
FireEye Generic.mg.a48dc2da2655fd04
McAfee GenericRXAA-AA!A48DC2DA2655
Cylance Unsafe
Symantec Trojan.Amadey
ESET-NOD32 Win32/Spy.Delf.QYF
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
ClamAV Win.Malware.Zusy-9770522-0
Kaspersky HEUR:Trojan-Spy.Win32.Bobik.gen
BitDefender Gen:Variant.Doina.2666
NANO-Antivirus Trojan.Win32.Plodor.iaklyz
Rising Stealer.Agent!1.D216 (RDMK:cmRtazp1fSs81M45Sd7wkK4Qo7uw)
Ad-Aware Gen:Variant.Doina.2666
Sophos ML/PE-A
DrWeb Trojan.PWS.Stealer.29417
Zillya Trojan.Delf.Win32.130455
TrendMicro TrojanSpy.Win32.AMADEY.SMYAAA-A
Emsisoft Trojan-Spy.Delf (A)
Jiangmin Trojan.Plodor.h
Avira HEUR/AGEN.1136939
Microsoft Trojan:Win32/EmotetCrypt.PEF!MTB
GData Gen:Variant.Doina.2666
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.Generic.C4077593
ALYac Gen:Variant.Doina.2666
MAX malware (ai score=86)
VBA32 TScope.Trojan.Delf
Malwarebytes Spyware.PasswordStealer
TrendMicro-HouseCall TrojanSpy.Win32.AMADEY.SMYAAA-A
Tencent Malware.Win32.Gencirc.10ce384c
MaxSecure Trojan.Malware.1728101.susgen
Fortinet W32/Delf.QYF!tr.spy
AVG Win32:TrojanX-gen [Trj]
Panda Trj/GdSda.A