ScreenShot
| Created | 2024.08.07 10:04 | Machine | s1_win7_x6403 |
| Filename | amadey.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 52 detected (AIDetectMalware, Amadey, malicious, high confidence, score, Zusy, Unsafe, Save, Attribute, HighConfidence, FCND, CLOUD, Static AI, Malicious PE, Detected, AGEN, ai score=88, Eldorado, ZexaF, quW@aymJhBgi, R002C0DH624, Pgil, Genetic, confidence, 100%) | ||
| md5 | 107c3b33e05d1d569cccc2052e56055e | ||
| sha256 | 6338b823d5172f0321814534c1d7aff08a60132c62de48c2752c2c7dfc191228 | ||
| ssdeep | 6144:og7RU92ushCQjrnlNTnbWRp1MHuqbMlAOxyYizl7:mTshCQjrnlluMHuqberyT7 | ||
| imphash | dc5e346c01606ee3d3aee4549b4acd39 | ||
| impfuzzy | 48:OeRHXr2ncGOac+JbAtSS1jGoZcc6g3GAF57fwwRLP2HN+5TPg:vZXlGLc+JMtSS1jGoZc9c7RLCSzg | ||
Network IP location
Signature (29cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 52 AntiVirus engines on VirusTotal as malicious |
| watch | Attempts to access Bitcoin/ALTCoin wallets |
| watch | Attempts to identify installed AV products by installation directory |
| watch | Communicates with host for which no DNS query was performed |
| watch | Harvests credentials from local email clients |
| watch | Harvests credentials from local FTP client softwares |
| watch | Harvests information related to installed instant messenger clients |
| watch | Installs itself for autorun at Windows startup |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An executable file was downloaded by the process utsysc.exe |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | This executable has a PDB path |
| info | Tries to locate where the browsers are installed |
Rules (18cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win_Amadey_Zero | Amadey bot | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | JPEG_Format_Zero | JPEG Format | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (33cnts) ?
Suricata ids
ET DROP Spamhaus DROP Listed Traffic Inbound group 25
ET MALWARE Amadey Bot Activity (POST) M1
ET INFO Dotted Quad Host DLL Request
ET POLICY PE EXE or DLL Windows file download HTTP
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
ET MALWARE Amadey Bot Activity (POST) M1
ET INFO Dotted Quad Host DLL Request
ET POLICY PE EXE or DLL Windows file download HTTP
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x430044 Sleep
0x430048 GetTempPathA
0x43004c GetLastError
0x430050 GetFileAttributesA
0x430054 CreateFileA
0x430058 CloseHandle
0x43005c GetSystemInfo
0x430060 CreateThread
0x430064 GetThreadContext
0x430068 SetCurrentDirectoryA
0x43006c VirtualAllocEx
0x430070 RemoveDirectoryA
0x430074 ReadProcessMemory
0x430078 CreateProcessA
0x43007c CreateDirectoryA
0x430080 SetThreadContext
0x430084 ReadConsoleW
0x430088 SetEndOfFile
0x43008c HeapSize
0x430090 SetFilePointerEx
0x430094 GetModuleHandleA
0x430098 ResumeThread
0x43009c GetComputerNameExW
0x4300a0 GetVersionExW
0x4300a4 CreateMutexA
0x4300a8 PeekNamedPipe
0x4300ac VirtualAlloc
0x4300b0 WriteFile
0x4300b4 VirtualFree
0x4300b8 WriteProcessMemory
0x4300bc GetModuleFileNameA
0x4300c0 GetProcAddress
0x4300c4 ReadFile
0x4300c8 GetConsoleMode
0x4300cc GetConsoleCP
0x4300d0 FlushFileBuffers
0x4300d4 GetProcessHeap
0x4300d8 SetEnvironmentVariableW
0x4300dc FreeEnvironmentStringsW
0x4300e0 GetEnvironmentStringsW
0x4300e4 GetOEMCP
0x4300e8 GetACP
0x4300ec IsValidCodePage
0x4300f0 FindNextFileW
0x4300f4 FindFirstFileExW
0x4300f8 FindClose
0x4300fc GetTimeZoneInformation
0x430100 HeapReAlloc
0x430104 SetStdHandle
0x430108 GetFullPathNameW
0x43010c GetCurrentDirectoryW
0x430110 DeleteFileW
0x430114 HeapAlloc
0x430118 HeapFree
0x43011c WideCharToMultiByte
0x430120 EnterCriticalSection
0x430124 LeaveCriticalSection
0x430128 DeleteCriticalSection
0x43012c SetLastError
0x430130 InitializeCriticalSectionAndSpinCount
0x430134 CreateEventW
0x430138 TlsAlloc
0x43013c TlsGetValue
0x430140 TlsSetValue
0x430144 TlsFree
0x430148 GetSystemTimeAsFileTime
0x43014c GetModuleHandleW
0x430150 EncodePointer
0x430154 DecodePointer
0x430158 MultiByteToWideChar
0x43015c CompareStringW
0x430160 LCMapStringW
0x430164 GetStringTypeW
0x430168 GetCPInfo
0x43016c SetEvent
0x430170 ResetEvent
0x430174 WaitForSingleObjectEx
0x430178 IsDebuggerPresent
0x43017c UnhandledExceptionFilter
0x430180 SetUnhandledExceptionFilter
0x430184 GetStartupInfoW
0x430188 IsProcessorFeaturePresent
0x43018c QueryPerformanceCounter
0x430190 GetCurrentProcessId
0x430194 GetCurrentThreadId
0x430198 InitializeSListHead
0x43019c GetCurrentProcess
0x4301a0 TerminateProcess
0x4301a4 RaiseException
0x4301a8 RtlUnwind
0x4301ac FreeLibrary
0x4301b0 LoadLibraryExW
0x4301b4 ExitProcess
0x4301b8 GetModuleHandleExW
0x4301bc CreateFileW
0x4301c0 GetDriveTypeW
0x4301c4 GetFileInformationByHandle
0x4301c8 GetFileType
0x4301cc SystemTimeToTzSpecificLocalTime
0x4301d0 FileTimeToSystemTime
0x4301d4 GetModuleFileNameW
0x4301d8 GetStdHandle
0x4301dc GetCommandLineA
0x4301e0 GetCommandLineW
0x4301e4 WriteConsoleW
USER32.dll
0x430200 GetSystemMetrics
0x430204 ReleaseDC
0x430208 GetDC
GDI32.dll
0x43002c CreateCompatibleBitmap
0x430030 SelectObject
0x430034 CreateCompatibleDC
0x430038 DeleteObject
0x43003c BitBlt
ADVAPI32.dll
0x430000 RegCloseKey
0x430004 RegGetValueA
0x430008 RegQueryValueExA
0x43000c GetSidSubAuthorityCount
0x430010 GetSidSubAuthority
0x430014 GetUserNameA
0x430018 LookupAccountNameA
0x43001c RegSetValueExA
0x430020 RegOpenKeyExA
0x430024 GetSidIdentifierAuthority
SHELL32.dll
0x4301ec SHGetFolderPathA
0x4301f0 ShellExecuteA
0x4301f4 None
0x4301f8 SHFileOperationA
WININET.dll
0x430210 HttpOpenRequestA
0x430214 InternetReadFile
0x430218 InternetConnectA
0x43021c HttpSendRequestA
0x430220 InternetCloseHandle
0x430224 InternetOpenA
0x430228 HttpSendRequestExA
0x43022c HttpAddRequestHeadersA
0x430230 HttpEndRequestA
0x430234 InternetOpenW
0x430238 InternetOpenUrlA
0x43023c InternetWriteFile
gdiplus.dll
0x430244 GdipSaveImageToFile
0x430248 GdipGetImageEncodersSize
0x43024c GdipDisposeImage
0x430250 GdipCreateBitmapFromHBITMAP
0x430254 GdipGetImageEncoders
0x430258 GdiplusShutdown
0x43025c GdiplusStartup
EAT(Export Address Table) is none
KERNEL32.dll
0x430044 Sleep
0x430048 GetTempPathA
0x43004c GetLastError
0x430050 GetFileAttributesA
0x430054 CreateFileA
0x430058 CloseHandle
0x43005c GetSystemInfo
0x430060 CreateThread
0x430064 GetThreadContext
0x430068 SetCurrentDirectoryA
0x43006c VirtualAllocEx
0x430070 RemoveDirectoryA
0x430074 ReadProcessMemory
0x430078 CreateProcessA
0x43007c CreateDirectoryA
0x430080 SetThreadContext
0x430084 ReadConsoleW
0x430088 SetEndOfFile
0x43008c HeapSize
0x430090 SetFilePointerEx
0x430094 GetModuleHandleA
0x430098 ResumeThread
0x43009c GetComputerNameExW
0x4300a0 GetVersionExW
0x4300a4 CreateMutexA
0x4300a8 PeekNamedPipe
0x4300ac VirtualAlloc
0x4300b0 WriteFile
0x4300b4 VirtualFree
0x4300b8 WriteProcessMemory
0x4300bc GetModuleFileNameA
0x4300c0 GetProcAddress
0x4300c4 ReadFile
0x4300c8 GetConsoleMode
0x4300cc GetConsoleCP
0x4300d0 FlushFileBuffers
0x4300d4 GetProcessHeap
0x4300d8 SetEnvironmentVariableW
0x4300dc FreeEnvironmentStringsW
0x4300e0 GetEnvironmentStringsW
0x4300e4 GetOEMCP
0x4300e8 GetACP
0x4300ec IsValidCodePage
0x4300f0 FindNextFileW
0x4300f4 FindFirstFileExW
0x4300f8 FindClose
0x4300fc GetTimeZoneInformation
0x430100 HeapReAlloc
0x430104 SetStdHandle
0x430108 GetFullPathNameW
0x43010c GetCurrentDirectoryW
0x430110 DeleteFileW
0x430114 HeapAlloc
0x430118 HeapFree
0x43011c WideCharToMultiByte
0x430120 EnterCriticalSection
0x430124 LeaveCriticalSection
0x430128 DeleteCriticalSection
0x43012c SetLastError
0x430130 InitializeCriticalSectionAndSpinCount
0x430134 CreateEventW
0x430138 TlsAlloc
0x43013c TlsGetValue
0x430140 TlsSetValue
0x430144 TlsFree
0x430148 GetSystemTimeAsFileTime
0x43014c GetModuleHandleW
0x430150 EncodePointer
0x430154 DecodePointer
0x430158 MultiByteToWideChar
0x43015c CompareStringW
0x430160 LCMapStringW
0x430164 GetStringTypeW
0x430168 GetCPInfo
0x43016c SetEvent
0x430170 ResetEvent
0x430174 WaitForSingleObjectEx
0x430178 IsDebuggerPresent
0x43017c UnhandledExceptionFilter
0x430180 SetUnhandledExceptionFilter
0x430184 GetStartupInfoW
0x430188 IsProcessorFeaturePresent
0x43018c QueryPerformanceCounter
0x430190 GetCurrentProcessId
0x430194 GetCurrentThreadId
0x430198 InitializeSListHead
0x43019c GetCurrentProcess
0x4301a0 TerminateProcess
0x4301a4 RaiseException
0x4301a8 RtlUnwind
0x4301ac FreeLibrary
0x4301b0 LoadLibraryExW
0x4301b4 ExitProcess
0x4301b8 GetModuleHandleExW
0x4301bc CreateFileW
0x4301c0 GetDriveTypeW
0x4301c4 GetFileInformationByHandle
0x4301c8 GetFileType
0x4301cc SystemTimeToTzSpecificLocalTime
0x4301d0 FileTimeToSystemTime
0x4301d4 GetModuleFileNameW
0x4301d8 GetStdHandle
0x4301dc GetCommandLineA
0x4301e0 GetCommandLineW
0x4301e4 WriteConsoleW
USER32.dll
0x430200 GetSystemMetrics
0x430204 ReleaseDC
0x430208 GetDC
GDI32.dll
0x43002c CreateCompatibleBitmap
0x430030 SelectObject
0x430034 CreateCompatibleDC
0x430038 DeleteObject
0x43003c BitBlt
ADVAPI32.dll
0x430000 RegCloseKey
0x430004 RegGetValueA
0x430008 RegQueryValueExA
0x43000c GetSidSubAuthorityCount
0x430010 GetSidSubAuthority
0x430014 GetUserNameA
0x430018 LookupAccountNameA
0x43001c RegSetValueExA
0x430020 RegOpenKeyExA
0x430024 GetSidIdentifierAuthority
SHELL32.dll
0x4301ec SHGetFolderPathA
0x4301f0 ShellExecuteA
0x4301f4 None
0x4301f8 SHFileOperationA
WININET.dll
0x430210 HttpOpenRequestA
0x430214 InternetReadFile
0x430218 InternetConnectA
0x43021c HttpSendRequestA
0x430220 InternetCloseHandle
0x430224 InternetOpenA
0x430228 HttpSendRequestExA
0x43022c HttpAddRequestHeadersA
0x430230 HttpEndRequestA
0x430234 InternetOpenW
0x430238 InternetOpenUrlA
0x43023c InternetWriteFile
gdiplus.dll
0x430244 GdipSaveImageToFile
0x430248 GdipGetImageEncodersSize
0x43024c GdipDisposeImage
0x430250 GdipCreateBitmapFromHBITMAP
0x430254 GdipGetImageEncoders
0x430258 GdiplusShutdown
0x43025c GdiplusStartup
EAT(Export Address Table) is none