Overview

overview

10

Static

static

10

1692-5-0x0...ry.exe

windows7-x64

10

1692-5-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1692-5-0x0000000001340000-0x0000000001891000-memory.dmp

  • Size

    5.3MB

  • MD5

    94bf5f0d38972008c4dfa697dfed6653

  • SHA1

    fa4b006910e7f8be121eae596d37f54d2a9f9e21

  • SHA256

    0fe4a02d0f4b9e581960dfa6a8a69c5d130ae7b3f84cf1ebca0157f627a0d1a3

  • SHA512

    8341e2c654b141b3f985bbd897b611c0b18f3a98483839f42da4fdc136f68064bac58ed30aed6912b0f8856e02062b95321956a082c6e154ff720a2e520a5dc6

  • SSDEEP

    98304:ZWStZDNisQSOKsISQpzOf0QkYv4AB5DD:ZHrzSqup

Score
10/10
themidaamadey

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes
  • install_dir

    5454e6f062

  • install_file

    explorta.exe

  • strings_key

    c7a869c5ba1d72480093ec207994e2bf

  • url_paths

    /sev56rkm/index.php

rc4.plain

Signatures

  • Amadey family
    amadey
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1692-5-0x0000000001340000-0x0000000001891000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections