General

  • Target

    2520-2-0x0000000001150000-0x0000000001613000-memory.dmp

  • Size

    4.8MB

  • MD5

    91ae892624d7de0bd467a07b78fae834

  • SHA1

    1f54c04cc09bd90ac8bb2177aec9627804d56832

  • SHA256

    27739bd2829c64ab61924ed33a42fa7b17c9be76aece76824eef5b39777695df

  • SHA512

    373d3e3b6319efda1a9b12333e090a7c625c142625be20e1eaaedf6cebf2e279ae4ad52d59234f811adb4d98f98cb7b39cdb6bab2c94e908f3b7211987e96018

  • SSDEEP

    98304:L+VVsRlOJVS+8ou11Ntg95MTqYvFo2i1/k:Syfb1NK5MTXon2

Score
10/10

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2520-2-0x0000000001150000-0x0000000001613000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections