Overview

overview

10

Static

static

10

3064-2-0x0...ry.exe

windows7-x64

10

3064-2-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3064-2-0x0000000000DC0000-0x000000000126E000-memory.dmp

  • Size

    4.7MB

  • MD5

    5eab12f1f7d6acbf406e855cd1686052

  • SHA1

    6503e43f75dea03ae83b71e785a2ad4818838669

  • SHA256

    dad510506b418d545f0d31d66a8a8b167b6d52dc351ce4b8ef5da05f3cc4683e

  • SHA512

    072c6bb745cc5f78bf4b4b0897acdb5aef3e935878e5dfe09bbcca989b458a090c2da97c8abe41a9925c6850918da2044dd8ce0c8c3d3f25c5f65b479df5b96a

  • SSDEEP

    98304:Fk9ubgG1id/E+XJEwO9BsYcUouDMUHACjiDadX0:F959Bp4uDMA0+

Score
10/10
b68ccfamadey

Malware Config

Extracted

Family

amadey

Version

4.17

Botnet

b68ccf

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey family
    amadey
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3064-2-0x0000000000DC0000-0x000000000126E000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections