General

  • Target

    tmp

  • Size

    219KB

  • MD5

    a427281ec99595c2a977a70e0009a30c

  • SHA1

    c937c5d14127921f068a081bb3e8f450c9966852

  • SHA256

    40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

  • SHA512

    2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

  • SSDEEP

    6144:87Vj3uVUn27+6qQx41QPF2nnugMeS7SpY:6wYfQx9FOnugMeS7

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.78/help/index.php

Attributes
  • install_dir

    cb378487cf

  • install_file

    legota.exe

  • strings_key

    f3785cbeef2013b6724eed349fd316ba

rc4.plain

Signatures

  • Amadey family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • tmp
    .exe windows:6 windows x86

    3865972614d44e518713c9a6183fed14


    Headers

    Imports

    Sections