Overview

overview

10

Static

static

10

2196-15-0x...ry.exe

windows7-x64

2196-15-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2196-15-0x00000000009B0000-0x00000000012B9000-memory.dmp

  • Size

    9.0MB

  • MD5

    e2b032f34716bc20c578e006adbe9d24

  • SHA1

    251fc88963820c23efc5379de810409e87d8bf97

  • SHA256

    5e07ab91670f140e0f8dfb90dd8783d2cd37bd7490cfe7b49bffac78105e4b26

  • SHA512

    1f7a52379247acb178951139b6d3f7bff2a0454bcb51b4110eec33fadb03128deeb991777faae83d5522bbe3696e7db509d50300df3c97fbc0ab3f0314c2d5fb

  • SSDEEP

    98304:vhxcYDWIZKUL4o2u6pgZ4BRGLCQ/Pn4EHLioXsuOpRK+QxQy+G9k+/4tTa:v6sKEV2emGLCQ/P4aRcQxv+GWbTa

Score
10/10
themidaamadey

Malware Config

Extracted

Family

amadey

Version

4.13

C2

http://185.172.128.125

Attributes
  • install_dir

    4fdb51ccdc

  • install_file

    Utsysc.exe

  • strings_key

    a70b05054314f381be1ab9a5cdc8b250

  • url_paths

    /u6vhSc3PPq/index.php

rc4.plain

Signatures

  • Amadey family
    amadey
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2196-15-0x00000000009B0000-0x00000000012B9000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections