Overview

overview

10

Static

static

10

3304-2-0x0...ry.exe

windows7-x64

10

3304-2-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3304-2-0x0000000000FF0000-0x00000000014AA000-memory.dmp

  • Size

    4.7MB

  • MD5

    28a6cdd34b6d9cbb9db349dd5c1d17d1

  • SHA1

    0f18f9c38a832dd042b8f592d698a83e76c14da7

  • SHA256

    100b20eca8320d640ccfe2b07e03ed9b20c5764a6769d0206f68918eb7c28ce9

  • SHA512

    8280c7b77382958121e72a7e71814e009e8c4ddf85c132bcece2a9424c29ba68624561a0d01578e4f1f03f82a8b794dd2fc340a5532001e64c74802871d708e2

  • SSDEEP

    98304:sWE9K7v2Gs9ptCsVf4+hLdc6xKbxoXeBCq+QMfyEBAzJod0SKIk1ESWrFl:sWL23dEbOXekzBAiuAD

Score
10/10
amadey

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey family
    amadey
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3304-2-0x0000000000FF0000-0x00000000014AA000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections