General

  • Target

    mkpub_part_a.zip

  • Size

    756KB

  • MD5

    9a7c1989736fbff2c7b7320e33ebc4a3

  • SHA1

    aa129c50b5cc73545044db9783dfcaae51a6177a

  • SHA256

    ce9c6915ead719b2079c1e9092e9162e69730ba51ca1e6da1f9cfa69ec48c377

  • SHA512

    5da884bd2c747e7e0ac9cb75398d7a9dad8be9d6de7292d7523d181dd350da57f806e46255cc3ee9b6d09fd76d9d3a96a87285daa850c83f1deaa44526d3d090

  • SSDEEP

    12288:S7LcD2Lk58wQxPd9UDsojqQnFvuS2FtJ6kUP72pE+r5YYNJA2xV4Iej7kphGSsg:d6Lkuj5EsUuTFtJ4PiSEvJkHkRsg

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Signatures

  • Amadey family
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • mkpub_part_a.zip
    .zip

    Password: infected

  • 07c8ad2195949e03142d49ed59e851c2f7b9823eab51b3ec232f75ef866d01f7.bin
    .exe windows:5 windows x64

    Password: infected

    693ffa6b44cd751ceb9044bcc8975404


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236.bin
    .exe windows:6 windows x86

    Password: infected

    3865972614d44e518713c9a6183fed14


    Headers

    Imports

    Sections

  • 0ca5581683ce097e382c9bf177c33508110e79985b5332eadd3d806e2a8302e8.bin
    .dll windows:4 windows x86

    Password: infected

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • 1cbc53c7993f35b97dd450f01b0e972016fdbeff1aa2c2674235dd931fdda12e.bin
    .dll windows:4 windows x86

    Password: infected

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • 31793ff8cdff66c5eb829ff1637d12b7afebd5fc95794946baccb6e96bf54649.bin
    .exe windows:1 windows x86

    Password: infected


    Headers

    Sections