Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
amadey
Version
3.80
C2
http://45.15.156.208
http://second.amadgood.com
Attributes
-
install_dir
eb0f58bce7
-
install_file
oneetx.exe
-
strings_key
2b74c848ebcfe9bcac3cd4aec559934c
-
url_paths
/jd9dd3Vw/index.php
rc4.plain
Targets
-
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2